diff options
| author | Szymon Wilczek <swilczek.lx@gmail.com> | 2026-05-07 14:39:07 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-05-07 08:39:07 -0400 |
| commit | 0c3e6e1b0e6eecceff441691e98ffa6aeb894bb2 (patch) | |
| tree | fbe89af0d1203bec095cb8b6fce628b08caadb9c /runtime/lua/vim/_ftplugin/lua.lua | |
| parent | 7e778205ab5347735f5c75b9bce589d995c94e3a (diff) | |
| download | rneovim-0c3e6e1b0e6eecceff441691e98ffa6aeb894bb2.tar.gz rneovim-0c3e6e1b0e6eecceff441691e98ffa6aeb894bb2.tar.bz2 rneovim-0c3e6e1b0e6eecceff441691e98ffa6aeb894bb2.zip | |
fix(treesitter): crash in ts_parser_delete after gc #39497
Problem:
parser_gc() calls ts_parser_delete() but leaves the userdata pointer
pointing to freed memory. If the GC finalizer runs at an unexpected time
(e.g. inside nvim_buf_get_lines #39411), a stale pointer could cause a crash.
Solution:
- NULL out `*ud` after ts_parser_delete() in parser_gc()
- Update parser_check() to handle NULL with a clear error message,
guarding all parser methods against UAF
Co-authored-by: Lewis Russell <lewis6991@gmail.com>
Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
Diffstat (limited to 'runtime/lua/vim/_ftplugin/lua.lua')
0 files changed, 0 insertions, 0 deletions