Fix Uri IndexOutOfRangeException when parsing URIs with bidi control characters

src/libraries/System.Private.Uri/src/System/Uri.cs

@@ -2235,6 +2235,10 @@ private unsafe ParsingError PrivateParseMinimal()
                     if (newHost is not null)
                     {
                         _string = newHost;
+                        // newHost contains everything from the start through the end of the authority
+                        // with bidi characters removed. idx should point to the position right after
+                        // the authority in the new string, which is simply newHost.Length.
+                        idx = newHost.Length;
                     }
                 }
 

src/libraries/System.Private.Uri/tests/FunctionalTests/UriTests.cs

@@ -1001,5 +1001,21 @@ static void Test(string uriString)
                 Assert.Throws<OutOfMemoryException>(() => uri.AbsoluteUri);
             }
         }
+
+        [Theory]
+        [InlineData("/\\//")]
+        [InlineData("\\/\u200e")]
+        [InlineData("/\\\\-\u0100\r")]
+        [InlineData("\\\\\\\\\\")]
+        [InlineData("\\\\\u200E")]
+        [InlineData("\\\\\u200E:1234")]
+        [InlineData("\\\\\u200E//")]
+        [InlineData("\\\\\u200E//ab")]
+        public static void InvalidUriWithBidiControlCharacters_ThrowsUriFormatException(string uriString)
+        {
+            // These URIs should throw UriFormatException, not IndexOutOfRangeException
+            // Issue: https://github.com/dotnet/runtime/issues/18640
+            Assert.Throws<UriFormatException>(() => new Uri(uriString, UriKind.Absolute));
+        }
     }
 }