emacs/tree-sitter.tree-sitter
1
0
Fork 0
mirror of https://github.com/tree-sitter/tree-sitter.git synced 2026-09-10 07:36:22 -04:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(lib): bounds-check symbol and state ids in language lookups

Browse source 
`ts_language_next_state` indexed the parse table with the caller's `state`
and `symbol` without validating either, and `ts_language_subtypes` read
`symbol_metadata` before checking `supertype` was in range.
This commit is contained in:
Will Lillis 2026-08-29 18:56:57 -04:00
parent 5ddf71b9f4
commit f47170927d
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/src/language.c
View file

@ -129,7 +129,11 @@ const TSSymbol *ts_language_subtypes(
TSSymbol supertype,
uint32_t *length
) {
if (self->abi_version < LANGUAGE_VERSION_WITH_RESERVED_WORDS || !ts_language_symbol_metadata(self, supertype).supertype) {
if (
self->abi_version < LANGUAGE_VERSION_WITH_RESERVED_WORDS ||
supertype >= ts_language_symbol_count(self) ||
!ts_language_symbol_metadata(self, supertype).supertype
) {
*length = 0;
return NULL;
}
@ -234,7 +238,12 @@ TSStateId ts_language_next_state(
TSStateId state,
TSSymbol symbol
) {
if (symbol == ts_builtin_sym_error || symbol == ts_builtin_sym_error_repeat) {
if (
symbol == ts_builtin_sym_error ||
symbol == ts_builtin_sym_error_repeat ||
symbol >= self->symbol_count ||
state >= self->state_count
) {
return 0;
} else if (symbol < self->token_count) {
uint32_t count;