fix: add escape sequence validation

fix #335

decode_test.go

@@ -3959,3 +3959,12 @@ func TestIssue362(t *testing.T) {
 	assertErr(t, err)
 	assertEq(t, "TestEmbeddedPrimitiveAlias", originalCombiner, newCombiner)
 }
+
+func TestIssue335(t *testing.T) {
+	var v []string
+	in := []byte(`["\u","A"]`)
+	err := json.Unmarshal(in, &v)
+	if err == nil {
+		t.Errorf("unexpected success")
+	}
+}

internal/decoder/string.go

@@ -2,6 +2,7 @@ package decoder
 
 import (
 	"bytes"
+	"fmt"
 	"reflect"
 	"unicode"
 	"unicode/utf16"
@@ -323,6 +324,12 @@ func (d *stringDecoder) decodeByte(buf []byte, cursor int64) ([]byte, int64, err
 						if cursor+5 >= buflen {
 							return nil, 0, errors.ErrUnexpectedEndOfJSON("escaped string", cursor)
 						}
+						for i := int64(1); i <= 4; i++ {
+							c := char(b, cursor+i)
+							if !(('0' <= c && c <= '9') || ('a' <= c && c <= 'f') || ('A' <= c && c <= 'F')) {
+								return nil, 0, errors.ErrSyntax(fmt.Sprintf("json: invalid character %c in \\u hexadecimal character escape", c), cursor+i)
+							}
+						}
 						cursor += 5
 					default:
 						return nil, 0, errors.ErrUnexpectedEndOfJSON("escaped string", cursor)