morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4115] [Bug] Empty Obj-C category name aborts dispatch-metadata inspection and discards a valid class #1621

New issue

Closed

opened 2026-10-16 21:08:06 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-16 21:08:06 +00:00

Owner

Originally created by @sx4im on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4115

Before submitting

I searched open and closed issues and pull requests for related reports.
I removed credentials, private paths, and sensitive target data.

Area

Native inspection (Apple dispatch metadata)

Observed behavior

A Mach-O whose __objc_catlist holds a category with an empty (NUL-only) name makes decodeAppleDispatchMetadata throw a ZodError (objc_categories[0].name: too_small, minimum 1) instead of returning metadata. The valid class decoded from the same image is discarded with it.

This is the category sibling of #3873 (fixed for protocols by #4078): the protocol decoder now rejects an empty name inside its per-record boundary so it becomes a recorded failure and siblings survive, but the category decoder was missed.

Root cause

src/native/AppleObjcCategories.ts:52 reads the category name with read.string(read.pointer(category)) and pushes it unchecked, while objcCategorySchema (src/domain/native/objcSwiftMetadata.ts:174) requires name: z.string().min(1). The empty name sails through the per-category try/catch (which would have recorded a category_decode_failed issue) and detonates at the final objcSwiftMetadataSchema.parse.

Reproduction

Built an in-memory Mach-O fixture (same shape as the repo's AppleDispatchMetadata.test.ts category fixture) with the category name bytes set to just \0, then called decodeAppleDispatchMetadata(bytes, 100, provenance):

empty name: throws ZodError at objc_categories[0].name
control with "FixtureCategory\0": decodes fine, category and class both present

Main commit tested

b225765 (current main)

Suggested direction

Reject the empty name inside the per-category boundary, mirroring the protocol fix (TypeError("Objective-C protocol has an empty name") in AppleObjcProtocols.ts), so it is recorded as a category_decode_failed issue and the valid class survives.

Originally created by @sx4im on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4115 ### Before submitting - [x] I searched open and closed issues and pull requests for related reports. - [x] I removed credentials, private paths, and sensitive target data. ### Area Native inspection (Apple dispatch metadata) ### Observed behavior A Mach-O whose `__objc_catlist` holds a category with an empty (NUL-only) name makes `decodeAppleDispatchMetadata` throw a `ZodError` (`objc_categories[0].name`: too_small, minimum 1) instead of returning metadata. The valid class decoded from the same image is discarded with it. This is the category sibling of #3873 (fixed for protocols by #4078): the protocol decoder now rejects an empty name inside its per-record boundary so it becomes a recorded failure and siblings survive, but the category decoder was missed. ### Root cause `src/native/AppleObjcCategories.ts:52` reads the category name with `read.string(read.pointer(category))` and pushes it unchecked, while `objcCategorySchema` (`src/domain/native/objcSwiftMetadata.ts:174`) requires `name: z.string().min(1)`. The empty name sails through the per-category `try/catch` (which would have recorded a `category_decode_failed` issue) and detonates at the final `objcSwiftMetadataSchema.parse`. ### Reproduction Built an in-memory Mach-O fixture (same shape as the repo's `AppleDispatchMetadata.test.ts` category fixture) with the category name bytes set to just `\0`, then called `decodeAppleDispatchMetadata(bytes, 100, provenance)`: - empty name: throws `ZodError` at `objc_categories[0].name` - control with `"FixtureCategory\0"`: decodes fine, category and class both present ### Main commit tested `b225765` (current `main`) ### Suggested direction Reject the empty name inside the per-category boundary, mirroring the protocol fix (`TypeError("Objective-C protocol has an empty name")` in `AppleObjcProtocols.ts`), so it is recorded as a `category_decode_failed` issue and the valid class survives.

bsakaguchi closed this issue

2026-10-31 00:31:51 +00:00

bsakaguchi commented

2026-10-31 00:31:52 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 18, 2026):

Checked on Linux: this is fixed on main by a70c42e03. The commit's message says "Refs #4115", which is why GitHub left this issue open.

src/native/AppleDispatchMetadata.test.ts passes on main 36d156ff0 on Node 22.23.1, 24.18.0 and 26.11.1 (52 tests).
On the commit's parent, 7 of 57 tests fail, including the empty category name case, ZodError (too_small) at objc_categories[0].name.
The test checks the partial-coverage reason, not the literal category_decode_failed code.

Thanks, sx4im, for the clear report.

If nothing else is open here, this can be closed.

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 18, 2026): Checked on Linux: this is fixed on main by a70c42e03. The commit's message says "Refs #4115", which is why GitHub left this issue open. - `src/native/AppleDispatchMetadata.test.ts` passes on main 36d156ff0 on Node 22.23.1, 24.18.0 and 26.11.1 (52 tests). - On the commit's parent, 7 of 57 tests fail, including the empty category name case, `ZodError` (too_small) at `objc_categories[0].name`. - The test checks the partial-coverage reason, not the literal `category_decode_failed` code. Thanks, sx4im, for the clear report. If nothing else is open here, this can be closed. 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-31 00:31:53 +00:00

Author

Owner

@sx4im commented on GitHub (Oct 18, 2026):

Closing this — fixed on main by a70c42e0. Thanks CassieFox23 for verifying it on Linux; the commit only referenced the issue, which is why it stayed open.

@sx4im commented on GitHub (Oct 18, 2026): Closing this — fixed on main by a70c42e0. Thanks CassieFox23 for verifying it on Linux; the commit only referenced the issue, which is why it stayed open.

bsakaguchi referenced this issue

2026-10-31 00:54:13 +00:00

[PR #1621] [MERGED] test: remove module and timestamp assumptions from boundary fixtures #4707

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1621

No description provided.

Rows
Columns