From 0e61867d9a03b5f4dbccc7cb884c8ce5e57a048a Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Sat, 6 Jun 2026 13:33:15 +0200 Subject: [PATCH] Fix start_tag leak in the vendored SQL scanner deserialize MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tree_sitter_sql_external_scanner_deserialize set state->start_tag = NULL and re-malloc'd it without freeing the previous allocation. tree-sitter calls deserialize repeatedly during a parse, leaking the prior start_tag each time (LeakSanitizer, Linux x64). Free it first — safe since create() NULL-inits it and destroy() frees+NULLs it. --- internal/cbm/vendored/grammars/sql/scanner.c | 1 + 1 file changed, 1 insertion(+) diff --git a/internal/cbm/vendored/grammars/sql/scanner.c b/internal/cbm/vendored/grammars/sql/scanner.c index 2277e4c65..fa3a9cb01 100644 --- a/internal/cbm/vendored/grammars/sql/scanner.c +++ b/internal/cbm/vendored/grammars/sql/scanner.c @@ -179,6 +179,7 @@ unsigned tree_sitter_sql_external_scanner_serialize(void *payload, char *buffer) void tree_sitter_sql_external_scanner_deserialize(void *payload, const char *buffer, unsigned length) { LexerState *state = (LexerState *)payload; + free(state->start_tag); /* deserialize is called repeatedly; free the prior tag first */ state->start_tag = NULL; // A length of 1 can't exists. if (length > 1) {