Escape invalid code points

base/json/string_escape.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/json/string_escape.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <limits>
@@ skipping 73 matching lines @@
   if (put_in_quotes)
     dest->push_back('"');
 
   // Casting is necessary because ICU uses int32_t. Try and do so safely.
   CHECK_LE(str.length(),
            static_cast<size_t>(std::numeric_limits<int32_t>::max()));
   const int32_t length = static_cast<int32_t>(str.length());
 
   for (int32_t i = 0; i < length; ++i) {
     uint32_t code_point;
-    if (!ReadUnicodeCharacter(str.data(), length, &i, &code_point)) {
+    if (!ReadUnicodeCharacter(str.data(), length, &i, &code_point) ||
+        code_point == static_cast<decltype(code_point)>(CBU_SENTINEL) ||
+        !IsValidCharacter(code_point)) {
       code_point = kReplacementCodePoint;
       did_replacement = true;
     }
 
     if (EscapeSpecialCodePoint(code_point, dest))
       continue;
 
     // Escape non-printing characters.
     if (code_point < 32)
       base::StringAppendF(dest, kU16EscapeFormat, code_point);
@@ skipping 53 matching lines @@
       dest.push_back(*it);
   }
 
   if (put_in_quotes)
     dest.push_back('"');
 
   return dest;
 }
 
 }  // namespace base