json_esc1: do not truncate length-delimited strings at an embedded NUL

The escape scan stopped on `(c = *s)`, treating a NUL byte as a string
terminator even when an explicit length was supplied -- silently
dropping everything from the first embedded NUL onward. Remove the NUL
guard from the loop condition: slen and max_output_size bound the loop,
NUL-terminated callers pass slen == strlen so they still stop at the NUL
exactly, and an embedded NUL is now emitted as its six-character unicode
hex escape via the existing control-character (JSON_ESC_CHAR) path.

tests: add strn-embedded-nul and keyn-embedded-nul, which write a
length-delimited value/key containing a NUL and assert it is escaped
(both fail against the pre-fix truncating scan). Suite: 52/52.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: liquidaty

tests/test.c

@@ -210,6 +210,22 @@ static void run_string_tests(void) {
   jsonwriter_end(h);
   done("strn-len", h, &s, "[\"hel\"]");
 
+  /* an embedded NUL is data, not a terminator: strn must escape it (\u0000)
+   * and keep writing the rest, not truncate the length-delimited string */
+  h = begin(&s, 1);
+  jsonwriter_start_array(h);
+  jsonwriter_cstrn(h, "a\0b", 3);
+  jsonwriter_end(h);
+  done("strn-embedded-nul", h, &s, "[\"a\\u0000b\"]");
+
+  /* same for a length-delimited object key */
+  h = begin(&s, 1);
+  jsonwriter_start_object(h);
+  jsonwriter_object_keyn(h, "k\0y", 3);
+  jsonwriter_cstr(h, "v");
+  jsonwriter_end(h);
+  done("keyn-embedded-nul", h, &s, "{\"k\\u0000y\":\"v\"}");
+
   /* quote + backslash escaping */
   h = begin(&s, 1);
   jsonwriter_start_array(h);

utils.c

@@ -35,7 +35,12 @@ static unsigned int json_esc1(const unsigned char *s, unsigned int slen,
     return 0;
   }
 
-  while(slen && (c = *s) && (size_t)(s - orig_s) < max_output_size) {
+  /* Length-delimited: an embedded NUL is data (escaped to a \u00 hex escape
+   * by the JSON_ESC_CHAR path below), not a terminator -- do not stop the scan
+   * on it. slen and max_output_size bound the loop; NUL-terminated callers pass
+   * slen == strlen, so they still stop at the NUL exactly. */
+  while(slen && (size_t)(s - orig_s) < max_output_size) {
+    c = *s;
     c_len = UTF8_charLenC(*s);
 
     if(c_len > 0 && ((unsigned char)c_len > slen || (size_t)((s - orig_s) + c_len) > max_output_size))