perform validity check when decoding utf-32 into itself

ostd/string.hh

@@ -767,17 +767,11 @@ namespace utf {
 
     /* @brief Get the Unicode code point from a UTF-32 string.
      *
-     * The string is advanced by one. This can only fail if the string
-     * is empty, `false` is returned in that case.
+     * The string is advanced by one. It can also fail if utf::isvalid()
+     * returns `false` for the front character, in which case the string
+     * will not be advanced.
      */
-    inline bool decode(u32string_range &r, char32_t &ret) noexcept {
-        if (r.empty()) {
-            return false;
-        }
-        ret = r.front();
-        r.pop_front();
-        return true;
-    }
+     bool decode(u32string_range &r, char32_t &ret) noexcept;
 
     /* @brief Get the Unicode code point for a wide Unicode char/sequence.
      *

src/string.cc

@@ -200,13 +200,31 @@ bool decode(u16string_range &r, char32_t &ret) noexcept {
     return false;
 }
 
+bool decode(u32string_range &r, char32_t &ret) noexcept {
+    if (r.empty()) {
+        return false;
+    }
+    auto c = r.front();
+    if (!utf::isvalid(c)) {
+        return false;
+    }
+    ret = c;
+    r.pop_front();
+    return true;
+}
+
 bool decode(wstring_range &r, char32_t &ret) noexcept {
     std::size_t n, tn = r.size();
     if constexpr(sizeof(wchar_t) == sizeof(char32_t)) {
         if (!tn) {
             return false;
         }
-        ret = char32_t(r.front());
+        auto c = char32_t(r.front());
+        if (!utf::isvalid(c)) {
+            return false;
+        }
+        ret = c;
+        r.pop_front();
         return true;
     } else if constexpr(sizeof(wchar_t) == sizeof(char16_t)) {
         auto *beg = reinterpret_cast<char16_t const *>(r.data());