fix: keep emoji escape tail bounded

.github/workflows/test_coverage.yml

@@ -76,6 +76,7 @@ jobs:
         if: github.event_name == 'pull_request'
         uses: codecov/codecov-action@v4
         with:
+          use_oidc: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
           files: coverage.dat
           verbose: true
           fail_ci_if_error: true

include/sonic/internal/arch/common/quote_common.h

@@ -157,17 +157,17 @@ sonic_static_inline void DoEscape(const char*& src, char*& dst, size_t& nb) {
           // Not enough bytes for a 4-byte emoji, handle as raw char or error
           *dst++ = *src++;
           nb--;
-          continue;
+        } else {
+          // TODO: validate the utf8?
+          uint32_t unicode = (src[0] & 0x07) << 18 | (src[1] & 0x3f) << 12 |
+                             (src[2] & 0x3f) << 6 | (src[3] & 0x3f);
+          unicode -= 0x10000;
+          writeHex<UnicodeEscapeUpperCase>(0xD800 | ((unicode >> 10) & 0x3FF),
+                                           dst);
+          writeHex<UnicodeEscapeUpperCase>(0xDC00 | (unicode & 0x3FF), dst);
+          src += 4;
+          nb -= 4;
         }
-        // TODO: validate the utf8?
-        uint32_t unicode = (src[0] & 0x07) << 18 | (src[1] & 0x3f) << 12 |
-                           (src[2] & 0x3f) << 6 | (src[3] & 0x3f);
-        unicode -= 0x10000;
-        writeHex<UnicodeEscapeUpperCase>(0xD800 | ((unicode >> 10) & 0x3FF),
-                                         dst);
-        writeHex<UnicodeEscapeUpperCase>(0xDC00 | (unicode & 0x3FF), dst);
-        src += 4;
-        nb -= 4;
       }
     }
 

tests/quote_test.cpp

@@ -40,6 +40,13 @@ void TestQuote(const std::string& input, const std::string& expect) {
   EXPECT_STREQ(buf.get(), expect.data());
 }
 
+void TestQuoteEscapeEmoji(const char* input, size_t n,
+                          const std::string& expect) {
+  auto buf = std::unique_ptr<char[]>(new char[(n + 2) * 12 + 32]);
+  char* end = Quote<SerializeFlags::kSerializeEscapeEmoji>(input, n, buf.get());
+  EXPECT_EQ(std::string(buf.get(), end - buf.get()), expect);
+}
+
 TEST(Quote, Normal) {
   std::vector<quoteTests> tests = {
       {"", "\"\""},
@@ -73,4 +80,11 @@ TEST(Quote, DiffSize) {
   }
 }
 
+TEST(Quote, EscapeEmojiStopsAtEndOfInvalidTail) {
+  const char input[] = {'\xfe', '\xff', '\xff'};
+  const char expect[] = {'"', '\xfe', '\xff', '\xff', '"'};
+  TestQuoteEscapeEmoji(input, sizeof(input),
+                       std::string(expect, sizeof(expect)));
+}
+
 }  // namespace