[0z5a]

The string-to-double converter accepts NULL for infinity_symbol / nan_symbol to disable them, but an empty string "" is also accepted. With an empty symbol, an input whose first character (after the sign) is '\0' matches the symbol's first character, which is its terminator. ConsumeSubString then advances past that terminator and keeps comparing the following input with whatever bytes come after the symbol in memory.

Effects, for inputs with an embedded NUL (the input is length-delimited, so this is possible):

• an out-of-bounds read of the bytes after the symbol (ASan reports a heap-buffer-overflow READ in ConsumeSubString when the symbol is a 1-byte heap allocation);
• if those bytes happen to match the input, the input is parsed as Infinity / NaN. For example, with the symbol stored as {'\0', 'x', '\0'}, the input {'\0', 'x'} returns inf with processed == 2.

This change makes ConsumeFirstCharacter return false for an empty symbol, so an empty symbol never matches, like NULL. Non-empty symbols are unaffected.

Test: a new EmptySpecialValueSymbols case in test/cctest/test-conversions.cc covers an empty infinity symbol and an empty NaN symbol, char and uc16 input, a leading sign, the case-insensitive path and StringToFloat, and checks that the other symbol and ordinary numbers still parse. On master it fails with Expected: 1.0, Found: inf; with this change it passes. ctest (9/9) passes in a Debug build with -fsanitize=address,undefined.

This change was drafted with Claude Code (claude-opus-5-5); the test results above are from the runs described.