The Problem

Not 100% confident I have the root cause, but here's the basic idea:

The full query:

(call_expression
  function: (scoped_identifier
    path: (scoped_identifier (identifier) @_regex (#any-of? @_regex "Regex" "RegexBuilder") .))
  (#set! injection.language "regex"))

For the stack frame that causes the OOB access, we're inside the for loop here:

and the start of the stream is pointing to (#any-of? @_regex "Regex" "RegexBuilder")...... Further down in the loop's body, step_index stores the value of self-steps.size here:

The recursive call to ts_query__parse_pattern immediately after parses the predicate (#any-of? @_regex "Regex" "RegexBuilder"). Parsing the predicate did not push new entries to self->steps, so when last_child_step_index is assigned to step_index following that call, it now indexes past the end of self->steps. The loop runs again, and this time it parses the anchor, here:

After this, another recursive call to ts_query__parse_pattern returns immediately with PARENT_DONE, since the stream now points to ). The first 3 if conditions following the recursive call are satisfied, so we then use the out of bounds last_child_step_index to index into self->steps.contents, causing the UB.

The Solution

Add a simple check for this case, decrementing step_index before its assignment to last_child_step_index if necessary.

• Fixes Undefined behaviour/out of bounds array access in query parser #4421