In base::JSONParser, check IsValidCharacter before decoding ASCII/UTF-8.

base/json/json_parser.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/json/json_parser.h"
 
 #include <cmath>
 #include <utility>
 
 #include "base/logging.h"
@@ skipping 652 matching lines @@
         // Allowed esape sequences:
         case 'x': {  // UTF-8 sequence.
           // UTF-8 \x escape sequences are not allowed in the spec, but they
           // are supported here for backwards-compatiblity with the old parser.
           if (!CanConsume(2)) {
             ReportError(JSONReader::JSON_INVALID_ESCAPE, 1);
             return false;
           }
 
           int hex_digit = 0;
-          if (!HexStringToInt(StringPiece(NextChar(), 2), &hex_digit)) {
+          if (!HexStringToInt(StringPiece(NextChar(), 2), &hex_digit) ||
+              !IsValidCharacter(hex_digit)) {
             ReportError(JSONReader::JSON_INVALID_ESCAPE, -1);
             return false;
           }
           NextChar();
 
           if (hex_digit < kExtendedASCIIStart)
             string.Append(static_cast<char>(hex_digit));
           else
             DecodeUTF8(hex_digit, &string);
           break;
@@ skipping 296 matching lines @@
                                            const std::string& description) {
   if (line || column) {
     return StringPrintf("Line: %i, column: %i, %s",
         line, column, description.c_str());
   }
   return description;
 }
 
 }  // namespace internal
 }  // namespace base