`tree_sitter_cpp_external_scanner_deserialize` doesn't bound `length` against the size of the delimiter buffer

[poly2it]

tree-sitter-cpp/src/scanner.c

Lines 135 to 143 in 8b5b49e

	void tree_sitter_cpp_external_scanner_deserialize(void *payload, const char *buffer, unsigned length) {
	assert(length % sizeof(wchar_t) == 0 && "Can't decode serialized delimiter!");
	Scanner *scanner = (Scanner *)payload;
	scanner->delimiter_length = length / sizeof(wchar_t);
	if (length > 0) {
	memcpy(&scanner->delimiter[0], buffer, length);
	}
	}

If the function is fed a buffer which exceeds the implicit bound of 64 bytes fed currently, the input can overflow onto the heap. This would be exploitable, if not for the fact that serialize only returns a maximum of MAX_DELIMITER_LENGTH * sizeof(wchar_t) == 64 bytes on Linux and MacOS.