)]}'
{
  "commit": "c9db4324aff387c811097101fac0b9414e28e9ac",
  "tree": "9ca20805ae00d7dd01c56681b3a056b631f4d806",
  "parents": [
    "e7e35bd81423ad06d659ca44664ab0c45382b98d"
  ],
  "author": {
    "name": "Yao Qi",
    "email": "yao_qi@apple.com",
    "time": "Thu Sep 24 08:27:23 2026 +0100"
  },
  "committer": {
    "name": "Copybara-Service",
    "email": "copybara-worker@google.com",
    "time": "Thu Sep 24 00:31:21 2026 -0700"
  },
  "message": "[lldb] Fix heap-buffer-overflow in tree-sitter-swift scanner state (#224001)\n\nRunning the `HighlighterTests` unit test under AddressSanitizer aborts\non every Swift test case, for example `SwiftComments`:\n\n```\n\u003d\u003d69424\u003d\u003dERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000008070 at pc 0x000116a1f36c bp 0x00016d07c3c0 sp 0x00016d07c3b8\nREAD of size 4 at 0x602000008070 thread T0\n    #0 0x000116a1f368 in eat_raw_str_part scanner.c:700\n    #1 0x000116a1b5f4 in tree_sitter_swift_external_scanner_scan scanner.c:858\n    #2 0x00012cc77420 in ts_parser_parse\n    #3 0x00012cc79afc in ts_parser_parse_string\n    #4 0x00010a3536a4 in lldb_private::TreeSitterHighlighter::Highlight(...)\n\n0x602000008071 is located 0 bytes after 1-byte region [0x602000008070,0x602000008071)\nallocated by thread T0 here:\n    #0 0x00012d68d560 in calloc\n    #1 0x00012cc763b8 in ts_parser_parse\n    #2 0x00012cc79afc in ts_parser_parse_string\n```\n\n`eat_raw_str_part` reads `state-\u003eongoing_raw_str_hash_count` as its\nfirst statement, a 4 byte field, but the scanner state was allocated\nwith:\n\n```\nvoid *tree_sitter_swift_external_scanner_create() {\n  return calloc(0, sizeof(struct ScannerState));\n}\n```\n\n`calloc` with an element count of 0 has no obligation to reserve room\nfor `sizeof(struct ScannerState)`, so it works by accident, but is\nfound by ASAN.\n\nFix it by allocating one instance, matching the Rust scanner and the\nstruct\u0027s actual use as a single persistent state object across calls.\n\nThe existing `HighlighterTest.Swift*` tests already exercise this path\nend to end and catch the regression under AddressSanitizer; no new\ntest is needed.\n\nGitOrigin-RevId: 93740deeaf7e4201d6117ba51d3f7f961a9d8d56\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dcb6bf802f45ce3807c44e369a00705965304346",
      "old_mode": 33188,
      "old_path": "source/Plugins/Highlighter/TreeSitter/Swift/tree-sitter-swift/scanner.c",
      "new_id": "3148218427c8c22e6712e1fa1d3d23132a06e48a",
      "new_mode": 33188,
      "new_path": "source/Plugins/Highlighter/TreeSitter/Swift/tree-sitter-swift/scanner.c"
    }
  ]
}