x/text/language: count '_' alongside '-' in ParseAcceptLanguage guard

language/parse.go

@@ -166,7 +166,9 @@ func ParseAcceptLanguage(s string) (tag []Tag, q []float32, err error) {
 		}
 	}()
 
-	if strings.Count(s, "-") > 1000 {
+	// The BCP 47 scanner aliases '_' to '-' in scanner.init
+	// (internal/language/parse.go); the guard must count both.
+	if strings.Count(s, "-")+strings.Count(s, "_") > 1000 {
 		return nil, nil, errTagListTooLarge
 	}
 

language/parse_test.go

@@ -407,3 +407,18 @@ func TestParseAcceptLanguageTooBig(t *testing.T) {
 		t.Errorf("ParseAcceptLanguage() unexpected error: got %v, want %v", err, errTagListTooLarge)
 	}
 }
+
+func TestParseAcceptLanguageUnderscoreGuard(t *testing.T) {
+	// Build a payload that would trigger the quadratic path with
+	// '_' but is blocked by the dash-count guard. Verify the guard
+	// now also counts '_'.
+	parts := make([]string, 0, 1002)
+	parts = append(parts, "en")
+	for i := 0; i < 1001; i++ {
+		parts = append(parts, "abcdefghi")
+	}
+	s := strings.Join(parts, "_")
+	if _, _, err := ParseAcceptLanguage(s); err != errTagListTooLarge {
+		t.Errorf("ParseAcceptLanguage with 1001 '_' separators: got err=%v, want errTagListTooLarge", err)
+	}
+}