mirror of
https://github.com/odin-lang/Odin.git
synced 2026-10-09 06:12:05 -04:00
Jack Mordaunt
641844dae7
unquote_string replaces each byte that is not valid UTF-8 with U+FFFD, which is three bytes for one, but sized its buffer as len(s) + 2*UTF_MAX: slack for a single replacement, not for one per invalid byte. A string holding several ran the write cursor past the end, an out-of-range slice under bounds checking and a memory-safety bug without it. Count the invalid bytes in the remainder up front and size for them. The escape sequences never grow their input, so they need no allowance.