common/json: fix out-of-bounds slice in the comment scanner

skipJSONString advances i by 2 on a backslash escape; when the backslash is the
last byte of the input, i is pushed past len(data) and returned unchanged. A
caller then slices data[keyStart:keyEnd] with keyEnd > len(data), panicking with
"slice bounds out of range". This is reachable from any untrusted JSON parsed by
the comment-aware decoder (e.g. a sing-box config or rule-set), e.g. the 12-byte
input {0000000#00000\n\ crashes it.

Clamp the returned index to len(data). Add FuzzUnmarshalExtended.

Author: AlexandrKhromov2005

common/json/fuzz_test.go

@@ -0,0 +1,18 @@
+package json_test
+
+import (
+	"testing"
+
+	"github.com/sagernet/sing/common/json"
+)
+
+// FuzzUnmarshalExtended fuzzes the comment-aware JSON decoder, which parses untrusted JSON
+// (e.g. sing-box config / rule-sets). It guards against panics such as the slice-bounds bug in
+// the comment scanner when a string escape runs off the end of the input.
+func FuzzUnmarshalExtended(f *testing.F) {
+	f.Add([]byte("{\"a\":1 // c\n}"))
+	f.Add([]byte("{\"a\\"))
+	f.Fuzz(func(t *testing.T, data []byte) {
+		_, _ = json.UnmarshalExtended[any](data)
+	})
+}

common/json/internal/contextjson/comment.go

@@ -211,6 +211,11 @@ func skipJSONString(data []byte, start int) int {
 			i++
 		}
 	}
+	// A trailing backslash escape (i += 2 on the last byte) can push i past the end; clamp so
+	// callers that slice data[:skipJSONString(...)] cannot go out of range.
+	if i > len(data) {
+		i = len(data)
+	}
 	return i
 }