Summary

• Move bounds check BEFORE write for 1-byte ASCII cases to prevent heap-buffer-overflow
• Fix two locations with the same "write-before-check" pattern (lines 123 and 141)
• The 2-byte, 3-byte, and 4-byte cases already correctly check before writing

Root Cause

The _safe function designed to prevent buffer overflows had a bug where it writes to the buffer BEFORE checking if there is sufficient space:

// BUG: write FIRST, check AFTER
*utf8_output++ = char(word);
pos++;
if (check_output && size_t(end - utf8_output) == 0) {  // Too late!

Fix

Move the check before the write:

// FIX: check FIRST, write AFTER
if (check_output && size_t(end - utf8_output) < 1) {
  return full_result(error_code::OUTPUT_BUFFER_TOO_SMALL, pos, utf8_output - start);
}
*utf8_output++ = char(word);
pos++;

Test Plan

• Verified fix with AddressSanitizer
• Original crash input no longer triggers overflow
• Normal conversion still works correctly

Fixes: #911