From 29d05589dc13589b72f4d5cd7fdf9c716d68d42e Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Thu, 16 Jul 2026 18:34:23 +0200 Subject: [PATCH] fix(grammars): widen uint8_t loop counters in objectscript scanner (CodeQL) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL cpp/comparison-with-wider-type (4 high-severity alerts, #69-#72) flagged two loops in the vendored ObjectScript scanner (objectscript_common.h, in both the _routine and _udl grammar copies) where a uint8_t counter is compared against an int length: the reverse_marker scan and the html_marker_buffer reversal. Both lengths are hard-bounded by MARKER_BUFFER_MAX_LEN (30), so the uint8_t counter can never wrap and the flagged infinite loop is unreachable in practice — but widening the counters to int removes the pattern and clears the gate. Provably behavior-neutral (int holds every uint8_t value; length <= 30). Recorded as a local modification in the vendored grammar MANIFEST so it is re-applied on the next re-vendor. Signed-off-by: Martin Vogel --- internal/cbm/vendored/grammars/MANIFEST.md | 2 +- .../grammars/objectscript_routine/objectscript_common.h | 4 ++-- .../vendored/grammars/objectscript_udl/objectscript_common.h | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/internal/cbm/vendored/grammars/MANIFEST.md b/internal/cbm/vendored/grammars/MANIFEST.md index 14a9e95f3..9c12a0b0f 100644 --- a/internal/cbm/vendored/grammars/MANIFEST.md +++ b/internal/cbm/vendored/grammars/MANIFEST.md @@ -13,7 +13,7 @@ The grammars were originally vendored as bare `parser.c`+`scanner.c` with **no r - ABI distribution: **7×** ABI-13 **85×** ABI-14 **64×** ABI-15 (runtime ceiling is ABI 15; never vendor ABI 16 without a runtime upgrade) - Vendored copies missing LICENSE: **0** — all upstream LICENSE files restored 2026-06-11 (first-party grammars carry the project MIT license; `move` uses the Helix-listed upstream tzakian/tree-sitter-move MIT text, `zsh` uses georgeharker/tree-sitter-zsh MIT) - `verdict`: VERIFIED-BOTH = our source matches *both* registries; VERIFIED-NVIM/HELIX = matches one; registry-disagreement = registries name a different repo (listed separately); `vendor-maintained` = the language vendor's own grammar, not in nvim/Helix. -- **objectscript_udl / objectscript_routine** (added 2026-06-24): vendored from [intersystems/tree-sitter-objectscript](https://github.com/intersystems/tree-sitter-objectscript) @ `a7ffcdf` — MIT, the InterSystems-official grammars (a niche vendor language, hence `vendor-maintained`, not in nvim-treesitter/Helix). **Re-vendor note:** each `scanner.c`'s upstream `#include "../../common/scanner.h"` is repointed to a per-directory `objectscript_common.h` (a verbatim copy of upstream `common/scanner.h`), because this repo's shared `vendored/common/scanner.h` belongs to the cfml/fsharp grammars and differs. The generated `parser.c`/`scanner.c` are otherwise byte-for-byte upstream — on re-vendor, re-apply only that single include rename. +- **objectscript_udl / objectscript_routine** (added 2026-06-24): vendored from [intersystems/tree-sitter-objectscript](https://github.com/intersystems/tree-sitter-objectscript) @ `a7ffcdf` — MIT, the InterSystems-official grammars (a niche vendor language, hence `vendor-maintained`, not in nvim-treesitter/Helix). **Re-vendor note:** each `scanner.c`'s upstream `#include "../../common/scanner.h"` is repointed to a per-directory `objectscript_common.h` (a verbatim copy of upstream `common/scanner.h`), because this repo's shared `vendored/common/scanner.h` belongs to the cfml/fsharp grammars and differs. The generated `parser.c`/`scanner.c` are otherwise byte-for-byte upstream — on re-vendor, re-apply only that single include rename. **Local modification (2026-07-16):** in `objectscript_common.h`, two loop counters `uint8_t i` were widened to `int i` (the `reverse_marker` scan and the `html_marker_buffer` reversal) to clear CodeQL `cpp/comparison-with-wider-type` — a false positive in practice (both lengths are hard-bounded by `MARKER_BUFFER_MAX_LEN = 30`, so `uint8_t` could never wrap), fixed for cleanliness. On re-vendor, re-apply this widening too (or upstream it at intersystems/tree-sitter-objectscript). - **mojo** (added 2026-07-01): vendored from [lsh/tree-sitter-mojo](https://github.com/lsh/tree-sitter-mojo) @ `33193a99afe6` — MIT, ABI 15. Helix tracks `lsh/tree-sitter-mojo` as its Mojo grammar source, but the Helix-pinned commit (`3d7c53b8038f`) no longer resolves in the upstream repository after a force-push, so this vendor uses current upstream `main` rather than the stale registry SHA. Security review covered only the vendored C surface (`parser.c`, `scanner.c`, `tree_sitter/*.h`) plus upstream license/provenance metadata; no package manager hooks, workflow files, prompt/agent instruction files, or generated lockfiles were vendored. > ⚠️ **Pinned commit = the revision nvim-treesitter/Helix vendor** (battle-tested, canonical source), not bleeding-edge HEAD. When re-vendoring, update the pinned commit here. diff --git a/internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h b/internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h index aa222075b..de5177ac1 100644 --- a/internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h +++ b/internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h @@ -332,7 +332,7 @@ static bool ObjectScript_Core_Scanner_lex_marker_fenced_text( lexer->mark_end(lexer); advance(lexer); - uint8_t i = 0; + int i = 0; while (i < reverse_marker_len && !lexer->eof(lexer) && lexer->lookahead == reverse_marker[i]) { advance(lexer); @@ -588,7 +588,7 @@ ObjectScript_Core_Scanner_scan(struct ObjectScript_Core_Scanner *scanner, return false; } scanner->js_marker_buffer_reversed_len = scanner->html_marker_buffer_len; - for (uint8_t i = 0; i < scanner->html_marker_buffer_len; i++) { + for (int i = 0; i < scanner->html_marker_buffer_len; i++) { if (scanner->html_marker_buffer[scanner->html_marker_buffer_len - 1 - i] == '[') { scanner->js_marker_buffer_reversed[i] = ']'; } diff --git a/internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h b/internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h index aa222075b..de5177ac1 100644 --- a/internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h +++ b/internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h @@ -332,7 +332,7 @@ static bool ObjectScript_Core_Scanner_lex_marker_fenced_text( lexer->mark_end(lexer); advance(lexer); - uint8_t i = 0; + int i = 0; while (i < reverse_marker_len && !lexer->eof(lexer) && lexer->lookahead == reverse_marker[i]) { advance(lexer); @@ -588,7 +588,7 @@ ObjectScript_Core_Scanner_scan(struct ObjectScript_Core_Scanner *scanner, return false; } scanner->js_marker_buffer_reversed_len = scanner->html_marker_buffer_len; - for (uint8_t i = 0; i < scanner->html_marker_buffer_len; i++) { + for (int i = 0; i < scanner->html_marker_buffer_len; i++) { if (scanner->html_marker_buffer[scanner->html_marker_buffer_len - 1 - i] == '[') { scanner->js_marker_buffer_reversed[i] = ']'; }