Out-of-bounds read (global-buffer-overflow) in the external scanner

Summary

• Repository: https://github.com/nushell/tree-sitter-nu
• Commit tested: d694570aa26b53d0d642460a0430e8aa07dcbea0
• Component: external scanner (src/scanner.c)
• Class: global-buffer-overflow
• Impact: the external scanner indexes past a global buffer (AddressSanitizer) — potential memory corruption. Any tool that parses untrusted input with this grammar (editors, language servers, syntax-highlighting services) is exposed.

Reproduce

Because this is an unpatched memory-corruption bug, I'm not publishing a working
reproducer here. I have a self-contained one — a build script plus the crashing input,
pinned to the commit above — and I'm glad to share it privately with a maintainer (or
attach it to the fix PR once a fix is in progress). Please reach out and I'll send it over.

Root cause

The crash is an out-of-range read of valid_symbols[ERROR_SENTINEL] (around line 116 of src/scanner.c): ERROR_SENTINEL does not correspond to a real external token slot — the scanner declares only 3 tokens in externals, so valid_symbols is sized for 3 — so indexing it with ERROR_SENTINEL reads past the end of the array.

Fix

I have a fix for this and will open a pull request shortly.

Provenance

Found with an automated libFuzzer + AddressSanitizer fuzzing pipeline, as part of a
research project on hardening tree-sitter grammars. Happy to coordinate on disclosure timing.

Start in src/scanner.c around line 116 and inspect how ERROR_SENTINEL is used with valid_symbols and how the three external tokens are declared. Request the private repro.sh and crash input, then run them under AddressSanitizer; done means the out-of-bounds read no longer occurs and the scanner tests still pass.