stdlib: Escape C1 control characters in bwrite_string unicode path

string_bin_escape_unicode/6 passed all bytes > 127 through without
checking for C1 control characters (U+0080-U+009F). These encode
as 0xC2 0x80-0x9F in UTF-8 and could enable terminal control
injection when rendering untrusted strings.

Fix by matching the specific two-byte C1 sequences and octal-escaping
them, consistent with the list-based write_string path.

Author: dgud

lib/stdlib/src/io_lib.erl

@@ -1084,6 +1084,22 @@ string_bin_escape_latin1(_, Orig, _, Acc, Skip, Len) ->
         false -> [Acc | binary_part(Orig, Skip, Len)]
     end.
 
+string_bin_escape_unicode(<<16#C2, Byte, Rest/binary>>, Orig, Q, Acc, Skip0, Len)
+  when Byte >= 16#80, Byte =< 16#9F ->
+    %% C1 control characters (U+0080-U+009F) - octal escape to match list path.
+    C1 = (Byte bsr 6) + $0,
+    C2 = ((Byte bsr 3) band 7) + $0,
+    C3 = (Byte band 7) + $0,
+    Escape = [$\\,C1,C2,C3],
+    case Len =:= 0 of
+        true ->
+            Skip = Skip0 + 2,
+            string_bin_escape_unicode(Rest, Orig, Q, [Acc | Escape], Skip, 0);
+        false ->
+            Skip = Skip0 + Len + 2,
+            Part = binary_part(Orig, Skip0, Len),
+            string_bin_escape_unicode(Rest, Orig, Q, [Acc, Part | Escape], Skip, 0)
+    end;
 string_bin_escape_unicode(<<Byte, Rest/binary>>, Orig, Q, Acc, Skip0, Len) when Byte > 127 ->
     string_bin_escape_unicode(Rest, Orig, Q, Acc, Skip0, Len+1);
 string_bin_escape_unicode(<<Byte, Rest/binary>>, Orig, Q, Acc, Skip0, Len) ->

lib/stdlib/test/io_SUITE.erl

@@ -2260,6 +2260,18 @@ otp_10302(Suite) when is_list(Suite) ->
                not is_latin1(S)],
     L2 = lists:seq(256, 512),
 
+    %% C1 controls (U+0080-U+009F) must be escaped in binary unicode path.
+    lists:foreach(
+      fun(C) ->
+              Bin = <<C/utf8>>,
+              Escaped = io_lib:bwrite_string(Bin, $", unicode),
+              %% Must not contain raw C1 bytes - should be octal-escaped.
+              nomatch = binary:match(Escaped, Bin),
+              %% Verify matches list path.
+              ListEsc = lists:flatten(io_lib:write_string([C])),
+              ListEsc = unicode:characters_to_list(Escaped)
+      end, lists:seq(16#80, 16#9F)),
+
     ok.
 
 pretty(Term, Depth) when is_integer(Depth) ->