From 22fe48147ef675b0d53b5b55dcdac44dc871ff3c Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Wed, 3 Jun 2026 02:13:30 +0200 Subject: [PATCH] Harden vendored nim scanner against empty deserialize buffer state_deserialize() dereferenced &buffer[0] and passed it to indent_vec_deserialize()'s nonnull argument even when buffer was NULL / buffer_len was 0 (the initial empty-state deserialize), tripping UBSan. Return early after clearing state when there is nothing to deserialize. --- internal/cbm/vendored/grammars/nim/scanner.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/internal/cbm/vendored/grammars/nim/scanner.c b/internal/cbm/vendored/grammars/nim/scanner.c index 6a10facf9..d1f2122da 100644 --- a/internal/cbm/vendored/grammars/nim/scanner.c +++ b/internal/cbm/vendored/grammars/nim/scanner.c @@ -360,6 +360,12 @@ _nonnull_(1) static void state_deserialize( DBG("error: no buffer but buffer length > 0"); return; } + /* Empty/absent buffer: nothing to deserialize. Return early so we never + * pass a null/zero-length pointer to indent_vec_deserialize's nonnull arg. */ + if (!buffer || buffer_len == 0) { + state_clear(self); + return; + } unsigned idx = 0; state_clear(self);