[kazinator]

In the same file:

  static bool is_java_identifier_start(char c)
  {
    return (isalpha(c) || c == '_' || c == '$');
  }

Undefined behavior in isalpha if c happens to be negative (and not equal to EOF), like some UTF-8 byte.

I think some <ctype.h> implementations are hardened against this issue, but not all.