From dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f Mon Sep 17 00:00:00 2001
From: Anas <alhachemi.anas@proton.me>
Date: Sun, 4 Oct 2026 17:59:21 +0200
Subject: [PATCH] chat-peg-parser : clear current_tool when pending_tool_call
 is reset (#29942)

A TOOL_ID node that arrives after TOOL_CLOSE wrote through `current_tool`,
which still pointed into the just-destroyed `pending_tool_call` optional
(use-after-free, then a second free of the id buffer). Clear the pointer on
reset.
---
 common/chat-peg-parser.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/common/chat-peg-parser.cpp b/common/chat-peg-parser.cpp
index f82797495..ee9a05fe0 100644
--- a/common/chat-peg-parser.cpp
+++ b/common/chat-peg-parser.cpp
@@ -451,6 +451,7 @@ void common_chat_peg_mapper::map(const common_peg_ast_node & node) {
                 result.tool_calls.push_back(pending_tool_call.value());
             }
             pending_tool_call.reset();
+            current_tool = nullptr;
         }
     }
 }