If bson_utf8_escape_for_json is called with an invalid sequence, e.g. one that begins with 0x80, it doesn't notice that bson_utf8_next_char and bson_utf8_get_char are returning nil. It loops forever on the invalid character, appending the escape sequence for nil, '\u0000', to the output string until it fails to realloc the output buffer and aborts.