[afonsojanu]

While looking at the *_with_len string setters I noticed verify_utf8_sequence decides how many bytes a UTF-8 sequence needs purely from its lead byte, then unconditionally reads that many bytes to build the code point, without checking whether that many bytes are actually still inside the caller's buffer.

If a string's last byte is a 2/3/4-byte lead byte whose continuation bytes have been cut off, the read goes past the given length. This is directly reachable from public API such as json_value_init_string_with_len and json_object_set_string_with_len, whenever the buffer isn't followed by a null byte, which is exactly the case those _with_len entry points are meant to support (binary-safe / length-prefixed strings).

Repro under AddressSanitizer:

size_t n = 3;
char *buf = malloc(n);
buf[0] = 'a'; buf[1] = 'b'; buf[2] = (char)0xF0; /* 4-byte lead, no continuation bytes */
json_value_init_string_with_len(buf, n);

==ERROR: AddressSanitizer: heap-buffer-overflow ...
READ of size 1 ...
    #0 verify_utf8_sequence parson.c:356
    #1 is_valid_utf8 parson.c:396
    #2 json_value_init_string_with_len parson.c:1659

The fix threads the number of bytes remaining in the input down into verify_utf8_sequence and bails out before it looks past that, instead of only trusting num_bytes_in_utf8_sequence() to know how far it's safe to look.

Added cases to test_suite_5 in tests.c covering truncated 2/3/4-byte sequences sitting at the very end of an exact-size heap buffer (these crash under ASan without the fix), plus a full 4-byte sequence occupying the whole buffer to make sure valid input at the boundary still parses. Ran the existing suite under ASan+UBSan (all 356 checks pass) and also rebuilt with the project's own -std=c89 -pedantic-errors and the C++ build, both clean.

(Replaces #228, which had a stray commit trailer that shouldn't have been there — same fix and tests, clean history.)

[kgabis]

Thanks, I've modified it a bit so that it's more aligned with parson's code style. Also changed tests so that this bug can be caught without asan.