Function injectLoneSurrogate

json_fuzz_test.go:835–876

injectLoneSurrogate corrupts a string by replacing a `\uXXXX` escape with a lone surrogate escape (\uD800 / \uDC00 alone, or a high-high pair). Targets the escape decoder's surrogate-combination path: it must refuse to combine these into a valid code point and must reject the string cleanly. If no `

(r *rand.Rand, data []byte)

// `\u` escape exists in data, the operator inserts a lone surrogate escape at
// a random string-body position instead.
func injectLoneSurrogate(r *rand.Rand, data []byte) []byte {
	// Find existing \u escapes.
	var escPos []int
	for i := 0; i+1 < len(data); i++ {
		if data[i] == '\\' && data[i+1] == 'u' {
			escPos = append(escPos, i)
		}
	}
	if len(escPos) > 0 {
		pos := escPos[r.Intn(len(escPos))]
		end := pos + 6
		if end > len(data) {
			end = len(data)
		}
		var seq []byte
		switch r.Intn(3) {
		case 0:
			seq = []byte(`\uD800`) // high alone
		case 1:
			seq = []byte(`\uDC00`) // low alone
		default:
			seq = []byte(`\uD800\uD800`) // two highs
		}
		out := make([]byte, 0, len(data)-6+len(seq))
		out = append(out, data[:pos]...)
		out = append(out, seq...)
		out = append(out, data[end:]...)
		return out
	}
	// Fallback: insert a lone-surrogate escape inside a string body.
	positions := stringInsertionPoints(data)
	if len(positions) == 0 {
		return data
	}
	pos := positions[r.Intn(len(positions))]
	seq := []byte(`\uD800`)
	out := make([]byte, 0, len(data)+len(seq))
	out = append(out, data[:pos]...)
	out = append(out, seq...)
	out = append(out, data[pos:]...)
	return out
}

// injectUnbalancedOpen inserts unmatched '{' or '[' opens at a random
// position. This produces structures the grammar generator CANNOT emit: