[Lldb-commits] [lldb] 93740de - [lldb] Fix heap-buffer-overflow in tree-sitter-swift scanner state (#224001)

[via lldb-commits]

Author: Yao Qi
Date: 2026-09-24T08:27:23+01:00
New Revision: 93740deeaf7e4201d6117ba51d3f7f961a9d8d56

URL: https://github.com/llvm/llvm-project/commit/93740deeaf7e4201d6117ba51d3f7f961a9d8d56
DIFF: https://github.com/llvm/llvm-project/commit/93740deeaf7e4201d6117ba51d3f7f961a9d8d56.diff

LOG: [lldb] Fix heap-buffer-overflow in tree-sitter-swift scanner state (#224001)

Running the `HighlighterTests` unit test under AddressSanitizer aborts
on every Swift test case, for example `SwiftComments`:

```
==69424==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000008070 at pc 0x000116a1f36c bp 0x00016d07c3c0 sp 0x00016d07c3b8
READ of size 4 at 0x602000008070 thread T0
    #0 0x000116a1f368 in eat_raw_str_part scanner.c:700
    #1 0x000116a1b5f4 in tree_sitter_swift_external_scanner_scan scanner.c:858
    #2 0x00012cc77420 in ts_parser_parse
    #3 0x00012cc79afc in ts_parser_parse_string
    #4 0x00010a3536a4 in lldb_private::TreeSitterHighlighter::Highlight(...)

0x602000008071 is located 0 bytes after 1-byte region [0x602000008070,0x602000008071)
allocated by thread T0 here:
    #0 0x00012d68d560 in calloc
    #1 0x00012cc763b8 in ts_parser_parse
    #2 0x00012cc79afc in ts_parser_parse_string
```

`eat_raw_str_part` reads `state->ongoing_raw_str_hash_count` as its
first statement, a 4 byte field, but the scanner state was allocated
with:

```
void *tree_sitter_swift_external_scanner_create() {
  return calloc(0, sizeof(struct ScannerState));
}
```

`calloc` with an element count of 0 has no obligation to reserve room
for `sizeof(struct ScannerState)`, so it works by accident, but is
found by ASAN.

Fix it by allocating one instance, matching the Rust scanner and the
struct's actual use as a single persistent state object across calls.

The existing `HighlighterTest.Swift*` tests already exercise this path
end to end and catch the regression under AddressSanitizer; no new
test is needed.

Added: 
    

Modified: 
    lldb/source/Plugins/Highlighter/TreeSitter/Swift/tree-sitter-swift/scanner.c

Removed: 
    


################################################################################
diff  --git a/lldb/source/Plugins/Highlighter/TreeSitter/Swift/tree-sitter-swift/scanner.c b/lldb/source/Plugins/Highlighter/TreeSitter/Swift/tree-sitter-swift/scanner.c
index dcb6bf802f45c..3148218427c8c 100644
--- a/lldb/source/Plugins/Highlighter/TreeSitter/Swift/tree-sitter-swift/scanner.c
+++ b/lldb/source/Plugins/Highlighter/TreeSitter/Swift/tree-sitter-swift/scanner.c
@@ -188,7 +188,7 @@ struct ScannerState {
 };
 
 void *tree_sitter_swift_external_scanner_create() {
-  return calloc(0, sizeof(struct ScannerState));
+  return calloc(1, sizeof(struct ScannerState));
 }
 
 void tree_sitter_swift_external_scanner_destroy(void *payload) {