Function injectInvalidUTF8

json_fuzz_test.go:804–827

injectInvalidUTF8 inserts a raw invalid-UTF-8 byte sequence inside a JSON string value. Targets the parser's UTF-8 validation path: the parser must reject cleanly, never panic. Covers overlong encodings (0xC0 0xAF), truncated sequences (lone leading byte), never-valid bytes (0xFF / 0xFE), and a UTF-

(r *rand.Rand, data []byte)

// sequences (lone leading byte), never-valid bytes (0xFF / 0xFE), and a UTF-8-
// encoded surrogate (which encoding/json rejects but some parsers accept).
func injectInvalidUTF8(r *rand.Rand, data []byte) []byte {
	positions := stringInsertionPoints(data)
	if len(positions) == 0 {
		return data
	}
	pos := positions[r.Intn(len(positions))]
	invalid := [][]byte{
		{0xC0, 0xAF},         // overlong '/'
		{0xC1, 0xBF},         // overlong 2-byte
		{0xE0, 0x80, 0xAF},   // overlong 3-byte
		{0xF0, 0x80, 0x80, 0x80}, // overlong 4-byte
		{0xE0},               // truncated 3-byte (lone leading byte)
		{0xF0, 0x80},         // truncated 4-byte
		{0xFF},               // never-valid byte
		{0xFE},               // never-valid byte
		{0xED, 0xA0, 0x80},   // UTF-8 encoding of U+D800 (lone surrogate)
	}
	seq := invalid[r.Intn(len(invalid))]
	out := make([]byte, 0, len(data)+len(seq))
	out = append(out, data[:pos]...)
	out = append(out, seq...)
	out = append(out, data[pos:]...)
	return out
}

// injectLoneSurrogate corrupts a string by replacing a `\uXXXX` escape with a
// lone surrogate escape (\uD800 / \uDC00 alone, or a high-high pair). Targets