[BUG] fastjson : jsonSkipString advances pointer past end on trailing backslash #15610

Describe the bug
In modules/vector-sets/fastjson.c, jsonSkipString() advances the parse pointer by 2 bytes on encountering a \ escape character, without first checking that a second byte exists before end:

if (**p == '\\') {
    (*p) += 2;
    continue;
}

If \ is the last byte before end, *p is advanced two bytes past the final valid position in one step.

To reproduce
Not currently reproducible as an observable crash. The following while (*p < end) loop condition catches the overrun and exits before any further dereference occurs, so no out-of-bounds read is actually performed today. However, advancing a pointer more than one past the end of an object is undefined behavior per the C standard.

Expected behavior
The bounds should be checked before advancing past the escape character, e.g.:

if (**p == '\\') {
    if (*p + 1 >= end) return 0; /* unterminated escape */
    (*p) += 2;
    continue;
}

Additional information
Found while auditing modules/vector-sets/ at commit 3acc0c49cf5ad2af9425d333e62728342dd6159b.