core: overlong UTF-8 encoding and surrogates (U+D800-DFFF) are invalid.