morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4368] [Bug] Empty Swift conformance names escape entry recovery and invalidate dispatch metadata #1725

New issue

Closed

opened 2026-10-16 21:09:30 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-16 21:09:30 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4368

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

SOURCE-ONLY: An empty type or protocol name in an admitted Swift conformance is appended without entry-level validation. The final whole-result schema rejects it after the per-conformance recovery block, preventing return of independently collected dispatch metadata.

Reproduction

SOURCE-ONLY. Runtime reproduction was not run. From each source checkout, I ran these inspection commands:

git rev-parse HEAD
sed -n '176,230p' src/native/NativeMacOSProvider.ts
sed -n '30,80p' src/native/AppleDispatchMetadata.ts
sed -n '114,165p' src/native/AppleDispatchMetadata.ts
sed -n '174,237p' src/native/AppleDispatchMetadata.ts
sed -n '98,166p' src/native/AppleSwiftDispatchFacets.ts
sed -n '223,248p' src/native/AppleSwiftDispatchFacets.ts
sed -n '189,199p' src/domain/native/objcSwiftMetadata.ts
sed -n '505,520p' src/native/AppleDispatchMetadata.test.ts

The concrete source-derived trigger is an otherwise admitted little-endian 64-bit Mach-O with a mapped __swift5_proto entry, supported protocol kind 3, supported direct type-reference kind 0 (or indirect kind 1), supported type kind 16/17/18, sufficient record budget, and a type-name or protocol-name relative pointer resolving to a file-backed NUL byte. All descriptor and pointer reads can succeed; a missing witness table is an accepted partial-conformance path. The empty string then reaches the conformance array. This is source inspection, not an executed binary fixture, CLI command, provider run, or measured incident frequency.

Expected behavior

Malformed conformances should become explicit per-conformance failures with partial coverage while independently decoded records remain available. The existing Swift catch emits conformance_decode_failed; the repository requires preserving partial facts and meaningful failure reasons, and the malformed-class sibling test demonstrates that recovery contract. Valid nonempty conformance names should remain represented.

Impact and scope

The affected case is malformed Swift metadata in a file-backed Mach-O. Source-derived consequence: no complete dispatch-metadata object is returned even though independent records may already have been decoded. NOT_ENOUGH_INFO: prevalence in real binaries, runtime error presentation, and alternate-provider workarounds were not measured.

REA version

Current main source 8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd; latest published rea-agents 6.5.0 source 3b79af28e80785afce9f5998d8f03289402a1847.

Runtime and platform

Source inspection on macOS arm64. REA, Node.js, Hopper and Ghidra were not executed for this finding; no engine version is asserted.

Target and artifact context

Little-endian 64-bit Mach-O with a mapped __swift5_proto conformance and a terminated empty type or protocol name, under the branch conditions above.

Interface

Other

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Static inspection on both source baselines establishes the same path: the production string reader returns "" for a mapped leading NUL; neither Swift name is checked before insertion; swiftConformanceSchema requires both names to have at least one character; and the final objcSwiftMetadataSchema.parse(result) runs after the entry catch. The later schema rejection therefore escapes conformance recovery. No runtime exception or CLI error output was observed.

Expected source: Repository partial-fact rule, the Swift per-entry catch and the malformed-class sibling test below.
Failure source: The concrete mapped-name path through the production reader, conformance insertion and final schema parse, shown in the pinned source below.
Evidence provenance: static
Local verification: static-proof
Reproduction completeness: complete

Runtime reproduction was not run; the supported entry point and relevant branch premises above establish the source-only path.

Native provider entry admits the Mach-O metadata operation and calls the digest-verified reader. Reader, facet call and final validation show that mapped terminated empty strings are accepted and final validation occurs after facets finish. Swift entry decode and recovery reads and inserts both names without a nonempty guard. Conformance schema rejects either empty name. Sibling preservation test retains valid classes beside a malformed class; it is cited as source, not as a test executed for this report.

Typed outcome or recovery expected

A returned metadata result retaining valid independent records, with an explicit failed-conformance issue and partial coverage. Proposed restoration check: the described empty-name case returns that partial result; a control differing only by nonempty type/protocol names retains the conformance. These runtime checks were not run.

Analysis or suspected cause

Source-derived reasoning: name reads succeed with zero characters, and the row is inserted before the whole-result minimum-length checks. A later schema rejection lies outside the existing entry recovery block. No implementation change is prescribed.

Additional context

Related Objective-C category issue #4115 and closed protocol issue #3873 concern different record decoders. The protocol fix and the open category PRs modify Objective-C paths, leaving this Swift conformance insertion unchanged. The separate Swift class-vtable owner path is outside this report; neither path must be fixed to verify the other.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: This bounded malformed-name path prevents returning the entire collected metadata result instead of retaining independent decoded facts. Prevalence in real artifacts and runtime presentation are unmeasured.
Workaround status: unverified
Workaround basis: No workaround was executed; whether an alternate provider can preserve the required binary metadata remains unverified.

Originally created by @coygeek on GitHub (Oct 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4368 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior SOURCE-ONLY: An empty type or protocol name in an admitted Swift conformance is appended without entry-level validation. The final whole-result schema rejects it after the per-conformance recovery block, preventing return of independently collected dispatch metadata. ### Reproduction SOURCE-ONLY. Runtime reproduction was not run. From each source checkout, I ran these inspection commands: ```sh git rev-parse HEAD sed -n '176,230p' src/native/NativeMacOSProvider.ts sed -n '30,80p' src/native/AppleDispatchMetadata.ts sed -n '114,165p' src/native/AppleDispatchMetadata.ts sed -n '174,237p' src/native/AppleDispatchMetadata.ts sed -n '98,166p' src/native/AppleSwiftDispatchFacets.ts sed -n '223,248p' src/native/AppleSwiftDispatchFacets.ts sed -n '189,199p' src/domain/native/objcSwiftMetadata.ts sed -n '505,520p' src/native/AppleDispatchMetadata.test.ts ``` The concrete source-derived trigger is an otherwise admitted little-endian 64-bit Mach-O with a mapped `__swift5_proto` entry, supported protocol kind 3, supported direct type-reference kind 0 (or indirect kind 1), supported type kind 16/17/18, sufficient record budget, and a type-name or protocol-name relative pointer resolving to a file-backed NUL byte. All descriptor and pointer reads can succeed; a missing witness table is an accepted partial-conformance path. The empty string then reaches the conformance array. This is source inspection, not an executed binary fixture, CLI command, provider run, or measured incident frequency. ### Expected behavior Malformed conformances should become explicit per-conformance failures with partial coverage while independently decoded records remain available. The existing Swift catch emits `conformance_decode_failed`; the repository requires preserving partial facts and meaningful failure reasons, and the malformed-class sibling test demonstrates that recovery contract. Valid nonempty conformance names should remain represented. ### Impact and scope The affected case is malformed Swift metadata in a file-backed Mach-O. Source-derived consequence: no complete dispatch-metadata object is returned even though independent records may already have been decoded. NOT_ENOUGH_INFO: prevalence in real binaries, runtime error presentation, and alternate-provider workarounds were not measured. ### REA version Current main source `8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd`; latest published rea-agents 6.5.0 source `3b79af28e80785afce9f5998d8f03289402a1847`. ### Runtime and platform Source inspection on macOS arm64. REA, Node.js, Hopper and Ghidra were not executed for this finding; no engine version is asserted. ### Target and artifact context Little-endian 64-bit Mach-O with a mapped `__swift5_proto` conformance and a terminated empty type or protocol name, under the branch conditions above. ### Interface Other ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence Static inspection on both source baselines establishes the same path: the production string reader returns `""` for a mapped leading NUL; neither Swift name is checked before insertion; `swiftConformanceSchema` requires both names to have at least one character; and the final `objcSwiftMetadataSchema.parse(result)` runs after the entry catch. The later schema rejection therefore escapes conformance recovery. No runtime exception or CLI error output was observed. - Expected source: [Repository partial-fact rule](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/AGENTS.md#architecture-and-cleanup), the Swift per-entry catch and the malformed-class sibling test below. - Failure source: The concrete mapped-name path through the production reader, conformance insertion and final schema parse, shown in the pinned source below. - Evidence provenance: static - Local verification: static-proof - Reproduction completeness: complete Runtime reproduction was not run; the supported entry point and relevant branch premises above establish the source-only path. [Native provider entry](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/src/native/NativeMacOSProvider.ts#L176-L230) admits the Mach-O metadata operation and calls the digest-verified reader. [Reader, facet call and final validation](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/src/native/AppleDispatchMetadata.ts#L30-L180) show that mapped terminated empty strings are accepted and final validation occurs after facets finish. [Swift entry decode and recovery](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/src/native/AppleSwiftDispatchFacets.ts#L98-L248) reads and inserts both names without a nonempty guard. [Conformance schema](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/src/domain/native/objcSwiftMetadata.ts#L189-L199) rejects either empty name. [Sibling preservation test](https://github.com/morluto/rea/blob/8ab5024397ddbd3b37ab68a13cabedc2eb7ce7dd/src/native/AppleDispatchMetadata.test.ts#L505-L520) retains valid classes beside a malformed class; it is cited as source, not as a test executed for this report. ### Typed outcome or recovery expected A returned metadata result retaining valid independent records, with an explicit failed-conformance issue and partial coverage. Proposed restoration check: the described empty-name case returns that partial result; a control differing only by nonempty type/protocol names retains the conformance. These runtime checks were not run. ### Analysis or suspected cause Source-derived reasoning: name reads succeed with zero characters, and the row is inserted before the whole-result minimum-length checks. A later schema rejection lies outside the existing entry recovery block. No implementation change is prescribed. ### Additional context Related Objective-C category issue [#4115](https://github.com/morluto/rea/issues/4115) and closed protocol issue [#3873](https://github.com/morluto/rea/issues/3873) concern different record decoders. The protocol fix and the open category PRs modify Objective-C paths, leaving this Swift conformance insertion unchanged. The separate Swift class-vtable owner path is outside this report; neither path must be fixed to verify the other. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: This bounded malformed-name path prevents returning the entire collected metadata result instead of retaining independent decoded facts. Prevalence in real artifacts and runtime presentation are unmeasured. - Workaround status: unverified - Workaround basis: No workaround was executed; whether an alternate provider can preserve the required binary metadata remains unverified.

bsakaguchi commented

2026-10-16 21:09:31 +00:00

Author

Owner

@HuXiangyu123 commented on GitHub (Oct 16, 2026):

I reproduced both empty-name cases on d72d856f58 using self-authored Mach-O bytes and the production metadata decoder (Linux x64, Node 24.18.0/npm 11.16.0). Both fail at whole-result validation; the nonempty-name control passes. I am preparing a focused AI-assisted draft that validates names inside per-conformance recovery and tests preservation of earlier/later Swift conformances, witness slots, Objective-C metadata, provenance and partial coverage. No macOS CLI/MCP or real-engine verification is claimed.

@HuXiangyu123 commented on GitHub (Oct 16, 2026): I reproduced both empty-name cases on d72d856f58d4747c5eb4307426e80d20934e017c using self-authored Mach-O bytes and the production metadata decoder (Linux x64, Node 24.18.0/npm 11.16.0). Both fail at whole-result validation; the nonempty-name control passes. I am preparing a focused AI-assisted draft that validates names inside per-conformance recovery and tests preservation of earlier/later Swift conformances, witness slots, Objective-C metadata, provenance and partial coverage. No macOS CLI/MCP or real-engine verification is claimed.

bsakaguchi referenced this issue

2026-10-17 21:02:55 +00:00

[GH-ISSUE #4271] [Bug] Colliding ZIP paths receive a false integrity diagnosis and ineffective retry advice #1687

bsakaguchi closed this issue

2026-10-31 00:32:22 +00:00

bsakaguchi commented

2026-10-31 00:32:23 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked the reported fix on main at d87e73f2db.

The original supported protocol/type descriptor paths now share a context reader that rejects a mapped empty string before returning it. Protocol and direct/indirect nominal-type readers catch this expected RangeError and retain a null name plus a reason; conformance insertion uses nullable names and partial decode, emits an issue, and continues instead of allowing an empty string to fail the final schema parse. Coverage becomes partial through the issue facts.

Implementation: AppleSwiftNominalTypes.ts, AppleSwiftConformanceTypeReference.ts.

The relevant regression checks in AppleDispatchMetadata.test.ts passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked the reported fix on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. The original supported protocol/type descriptor paths now share a context reader that rejects a mapped empty string before returning it. Protocol and direct/indirect nominal-type readers catch this expected RangeError and retain a null name plus a reason; conformance insertion uses nullable names and partial decode, emits an issue, and continues instead of allowing an empty string to fail the final schema parse. Coverage becomes partial through the issue facts. Implementation: [AppleSwiftNominalTypes.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/native/AppleSwiftNominalTypes.ts#L106), [AppleSwiftConformanceTypeReference.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/native/AppleSwiftConformanceTypeReference.ts#L123). The relevant regression checks in [AppleDispatchMetadata.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/native/AppleDispatchMetadata.test.ts) passed in the focused test run on this revision. This closure is based on the current source and those checks; provider fixtures do not establish a real-engine run. Closing as completed on main.

bsakaguchi referenced this issue

2026-10-31 00:54:58 +00:00

[PR #1726] [MERGED] fix(artifacts): preserve emitted ZIP entry identity #4780

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1725

No description provided.

Rows
Columns