ww source: reject raw NUL characters

internal/wwpackage/package.ww

@@ -624,6 +624,16 @@ fn pkgfailpath(path: str, reason: str) void = {
 	pkgputln(os.STDERR_FILENO, reason);
 };
 
+fn pkgfailsource(path: str, line: i32, col: i32, reason: str) void = {
+	pkgput(os.STDERR_FILENO, path);
+	pkgput(os.STDERR_FILENO, ":");
+	pkgput(os.STDERR_FILENO, strconv.i32tos(line, strconv.base.DEC));
+	pkgput(os.STDERR_FILENO, ":");
+	pkgput(os.STDERR_FILENO, strconv.i32tos(col, strconv.base.DEC));
+	pkgput(os.STDERR_FILENO, ": error: ");
+	pkgputln(os.STDERR_FILENO, reason);
+};
+
 fn pkgusage() void = {
 	pkgput(os.STDERR_FILENO,
 		"usage: wwtest package [-c] [-S] [-list] [-j N] [-I DIR] [-L DIR] [-l LIB] [-w DIR] [-run|-filter GLOB] [-timeout-ms=N] [DIR | DIR/... ...] [-- GLOB ...]\n");
@@ -689,6 +699,27 @@ fn pkgident(c: u8) bool = {
 	return c >= '0' && c <= '9';
 };
 
+fn pkgnulerrors(path: str, src: str) bool = {
+	let i: i32 = 0;
+	let ln: i32 = 1;
+	let cl: i32 = 1;
+	let found: bool = false;
+	for (i < src.len) {
+		if (src[i] == 0u8) {
+			pkgfailsource(path, ln, cl, "invalid NUL character");
+			found = true;
+		};
+		if (src[i] == '\n') {
+			ln += 1;
+			cl = 1;
+		} else {
+			cl += 1;
+		};
+		i += 1;
+	};
+	return found;
+};
+
 fn pkgskipspace(src: str, start: i32) i32 = {
 	let i: i32 = start;
 	for (i < src.len) {
@@ -2260,7 +2291,14 @@ export fn packagecommand(args: []str) int = {
 		};
 		let body: str;
 		let pn: str;
-		if (!pkgread(ds.paths[i], &body) || !pkgclause(body, &pn)) {
+		if (!pkgread(ds.paths[i], &body)) {
+			pkgfailpath(ds.paths[i], "invalid or missing package clause");
+			return pkgteststatusfail(explicitstatus, compileonly);
+		};
+		if (pkgnulerrors(ds.paths[i], body)) {
+			return pkgteststatusfail(explicitstatus, compileonly);
+		};
+		if (!pkgclause(body, &pn)) {
 			pkgfailpath(ds.paths[i], "invalid or missing package clause");
 			return pkgteststatusfail(explicitstatus, compileonly);
 		};