right, in that case it looks like the best bet is to use Encode::decode_utf8() over utf8::decode() as it will also put the 0xFFFD in place of the malformed characters eliminating peril of being fed with random data.

thanks!