[all-commits] [llvm/llvm-project] 93740d: [lldb] Fix heap-buffer-overflow in tree-sitter-swi...

[Yao Qi via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 93740deeaf7e4201d6117ba51d3f7f961a9d8d56
      https://github.com/llvm/llvm-project/commit/93740deeaf7e4201d6117ba51d3f7f961a9d8d56
  Author: Yao Qi <yao_qi at apple.com>
  Date:   2026-09-24 (Thu, 24 Sep 2026)

  Changed paths:
    M lldb/source/Plugins/Highlighter/TreeSitter/Swift/tree-sitter-swift/scanner.c

  Log Message:
  -----------
  [lldb] Fix heap-buffer-overflow in tree-sitter-swift scanner state (#224001)

Running the `HighlighterTests` unit test under AddressSanitizer aborts
on every Swift test case, for example `SwiftComments`:

```
==69424==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000008070 at pc 0x000116a1f36c bp 0x00016d07c3c0 sp 0x00016d07c3b8
READ of size 4 at 0x602000008070 thread T0
    #0 0x000116a1f368 in eat_raw_str_part scanner.c:700
    #1 0x000116a1b5f4 in tree_sitter_swift_external_scanner_scan scanner.c:858
    #2 0x00012cc77420 in ts_parser_parse
    #3 0x00012cc79afc in ts_parser_parse_string
    #4 0x00010a3536a4 in lldb_private::TreeSitterHighlighter::Highlight(...)

0x602000008071 is located 0 bytes after 1-byte region [0x602000008070,0x602000008071)
allocated by thread T0 here:
    #0 0x00012d68d560 in calloc
    #1 0x00012cc763b8 in ts_parser_parse
    #2 0x00012cc79afc in ts_parser_parse_string
```

`eat_raw_str_part` reads `state->ongoing_raw_str_hash_count` as its
first statement, a 4 byte field, but the scanner state was allocated
with:

```
void *tree_sitter_swift_external_scanner_create() {
  return calloc(0, sizeof(struct ScannerState));
}
```

`calloc` with an element count of 0 has no obligation to reserve room
for `sizeof(struct ScannerState)`, so it works by accident, but is
found by ASAN.

Fix it by allocating one instance, matching the Rust scanner and the
struct's actual use as a single persistent state object across calls.

The existing `HighlighterTest.Swift*` tests already exercise this path
end to end and catch the regression under AddressSanitizer; no new
test is needed.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications