From a81938d48564a93852fa89f544b9d5dc915b5da4 Mon Sep 17 00:00:00 2001 From: John Anderson Date: Thu, 24 Sep 2026 10:15:15 -0400 Subject: [PATCH] fix(scanner): don't write past the serialization buffer The indent loop in serialize checked for room for one byte and then wrote two. When the header and the saved string delimiters leave size odd, size can reach 1023, and the loop writes one byte past the 1024-byte buffer and returns 1025. The runtime's length assertion then aborts the process. Check for room for both bytes. Indents past the buffer are dropped, as they already are when size is even. Fixes #350 --- src/scanner.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/scanner.c b/src/scanner.c index 1fc77cdb..91678fd3 100644 --- a/src/scanner.c +++ b/src/scanner.c @@ -380,7 +380,7 @@ unsigned tree_sitter_python_external_scanner_serialize(void *payload, char *buff size += delimiter_count; uint32_t iter = 1; - for (; iter < scanner->indents.size && size < TREE_SITTER_SERIALIZATION_BUFFER_SIZE; ++iter) { + for (; iter < scanner->indents.size && size + 2 <= TREE_SITTER_SERIALIZATION_BUFFER_SIZE; ++iter) { uint16_t indent_value = *array_get(&scanner->indents, iter); buffer[size++] = (char)(indent_value & 0xFF); buffer[size++] = (char)((indent_value >> 8) & 0xFF);