fix(scanner): avoid out-of-bounds read of valid_symbols during error recovery

[xcthulhu]

Fixes #257

What

Fixes a global-buffer-overflow in the external scanner (src/scanner.c).

Root cause

The scanner reads valid_symbols[ERROR_SENTINEL] (around line 116), but ERROR_SENTINEL is not a declared external token — only 3 tokens are declared in externals, so valid_symbols is sized for 3 and the index reads past the end of the array.

Fix

Removes the invalid valid_symbols[ERROR_SENTINEL] access and instead detects error recovery by checking only the real, in-range token slots (RAW_STRING_BEGIN / RAW_STRING_CONTENT / RAW_STRING_END).

The patch was generated with LLM assistance and auto-verified: after applying it and
rebuilding at the tested commit, the crashing input no longer triggers the bug when replayed
under the same libFuzzer + AddressSanitizer time / memory budget. Please review it on those
terms — it may include incidental reformatting.

Provenance

Found with an automated libFuzzer + AddressSanitizer fuzzing pipeline, as part of a research
project on hardening tree-sitter grammars. A self-contained reproducer is available on
request (see the linked issue).

[fdncred]

Is it possible to have tests that support these changes?

[xcthulhu]

Is it possible to have tests that support these changes?

The failure is only reproducible with AddressSanitizer; I could incorporate it into your git workflow if you want.

[fdncred]

Never heard of it. Do you have a link to it where I can read up on it? I doubt we'd want to add it to our CI.