bug#42113: 28.0.50; Segmentation fault in json-parse-file

[Philipp Stephani]

Am Mo., 29. Juni 2020 um 11:39 Uhr schrieb Eli Zaretskii <eliz@gnu.org>:
>
> On June 29, 2020 11:33:45 AM GMT+03:00, Philipp Stephani 
> <p.stephani2@gmail.com> wrote:
> > Am So., 28. Juni 2020 um 23:53 Uhr schrieb Erik Hetzner <egh@e6h.org>:
> > >
> > > 1. Start emacs -Q
> > > 2. Evaluate the following
> > > (require 'dom)
> > >
> > > (with-current-buffer (url-retrieve-synchronously
> > "https://www.seriouseats.com/recipes/2020/06/florentine-omelette-spinach-and-cheese.html";)
> > >         (let* ((dom (libxml-parse-html-region (point-min)
> > (point-max)))
> > >                (scripts (dom-by-tag dom 'script))
> > >                (json-lds-raw (dom-elements scripts 'type
> > "^application/ld\\+json$"))
> > >                (json-lds (mapcar #'json-parse-string
> > json-lds-raw)))))
> > >
> > > Result: segmentation fault.
> >
> > Simpler: (json-parse-string 1)
> > The JSON functions are missing CHECK_STRING in several places where
> > json_encode is called.
>
> In this specific case I think the test is there, but it is done a bit too 
> late.  The call to check_string_without_embedded_nuls should be moved before 
> json_encode.

Is that always guaranteed to be correct though? Is there a guarantee
that encoding can never produce null bytes that weren't already
present in the input?