honor length in valueToQuotedString fast path (#1701)

src/lib_json/json_writer.cpp

diff --git a/src/lib_json/json_writer.cpp b/src/lib_json/json_writer.cpp
index ac14eb1..7279944 100644
--- a/src/lib_json/json_writer.cpp
+++ b/src/lib_json/json_writer.cpp
@@ -216,7 +216,7 @@
     return "";
 
   if (!doesAnyCharRequireEscaping(value, length))
-    return String("\"") + value + "\"";
+    return String("\"") + String(value, length) + "\"";
   // We have to walk value and escape any special characters.
   // Appending to String is not efficient, but this should be rare.
   // (Note: forward slashes are *not* rare, but I am not escaping them.)

src/test_lib_json/main.cpp

diff --git a/src/test_lib_json/main.cpp b/src/test_lib_json/main.cpp
index 90025b4..1c0377d 100644
--- a/src/test_lib_json/main.cpp
+++ b/src/test_lib_json/main.cpp
@@ -2850,6 +2850,16 @@
   }
 }
 
+// valueToQuotedString(value, length) must quote exactly `length` bytes and not
+// walk off the end of a buffer that is not NUL-terminated at that length.
+JSONTEST_FIXTURE_LOCAL(StreamWriterTest, quotedStringHonorsLength) {
+  // Bytes past position 5 must not leak into the output. Without honoring
+  // length the buffer is treated as a C-string and " world" is appended.
+  JSONTEST_ASSERT_STRING_EQUAL("\"hello\"",
+                               Json::valueToQuotedString("hello world", 5));
+  JSONTEST_ASSERT_STRING_EQUAL("\"\"", Json::valueToQuotedString("abc", 0));
+}
+
 JSONTEST_FIXTURE_LOCAL(StreamWriterTest, unicode) {
   // Create a Json value containing UTF-8 string with some chars that need
   // escape (tab,newline).