Files
weaseljson/corpus/2bc95b8d27fbc9fe709331004369df32619f71b8
andrew 08b864d31b
CI / build (-DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++, clang-arm64, ubuntu-latest-arm64, true) (push) Successful in 54s
CI / pre-commit (push) Successful in 53s
CI / build (-DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++, gcc-arm64, ubuntu-latest-arm64, false) (push) Successful in 50s
CI / build (-DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++, clang-amd64, ubuntu-latest-amd64, true) (push) Successful in 1m32s
CI / build (-DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++, gcc-amd64, ubuntu-latest-amd64, false) (push) Successful in 1m24s
Reject invalid UTF-16 surrogate pairs and lone low surrogates for clarity
The string unescape logic treated any code unit in the surrogate range

(0xD800-0xDFFF) as the start of a surrogate pair. The concrete example

from issue #39 (\uDC00\uDC00) was already rejected by the existing

0x10FFFF bounds check, but the check was misleading and would accept a

lone low surrogate as a regular BMP code point if the second surrogate

happened to be in a narrower range. Clean this up so the intent is

obvious.

Changes in src/parser3.h:

- Fast path (n_string2): only treat high surrogates (0xD800-0xDBFF) as

the start of a surrogate pair, and explicitly reject lone low surrogates

(0xDC00-0xDFFF).

- Slow path (t_hex2): same high-surrogate check, with explicit rejection

of lone low surrogates.

The t_hex3 path already validates that the second code unit is a low

surrogate (0xDC00-0xDFFF), so no change is needed there.

Also commit the current fuzzer corpus.

Closes #39
2026-06-29 13:37:58 -04:00

1 line
539 B
Plaintext
Raw Permalink Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
["\uDA9D\uDDDDux\uDA9D\uDDDdDux\uDA9D\uDDDduxux\uDA9D\uDDDdDDDux\uDA9D\uDDDeu|\uDA9D\uDDDDDDux\uDA9D\uDDDdDDADDDux\uDA9D\uDDDduxux\uDA9D\uDDDdD\uDA9D\uDDDduuDDA9D\uDA9D\uDDDDD-ux\uDA9D\uDDDdDDAuDDDDDDDux\uDA9D\uDDDduxux\uDA9D\uDDDdDux\uDA0D\uDDDdu|DDux\uDA9D\uDDDddDDDDDux\uDA9D\uDDDduxux\uDA9D\uDDDdDux\uDA9D\uDDDdu|DDux\uDA9D\uDDDddDDux\uDA9D\uDDDdu|\uDA4D\uDDA9D\u³D\uDA9D\uDDDDDDDDD\uDA9D\uDDDduxu\uDA9D\uDDDd:DEux\uDA9D\uDDDdDux\uDA9DDDDux\uDA9D\uDDD­du|\uDA8D\uDDDDDDDDux\uDA9D\uDDDddDDDx\uDA9D\uDDDd\uDA4D\uDDA0DDDux\uDA9D\uDDDdDDA0