morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4789] [Bug] Accepted XML integer overflow is reported as a non-finite real #2491

New issue

Closed

opened 2026-10-17 21:05:39 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-17 21:05:39 +00:00

Owner

Originally created by @morluto on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4789

Before submitting

I searched open and closed issues for a related report.
This uses self-authored input without credentials or sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

At 78cf6100f, the built CLI accepts a shallow XML keyed archive containing the finite integer 1 followed by 400 zeros, exits 0, and reports object 1 as an observed scalar with {"$plist_type":"real","value":null}. A limitation then claims one non-finite real was present. The source element is an integer, not a real.

Reproduction

After npm run build:cached, create this inert fixture and inspect it:

python3 - <<'PY'
from pathlib import Path
digits = '1' + '0' * 400
Path('large-integer.plist').write_text('<plist><dict><key>$archiver</key><string>NSKeyedArchiver</string><key>$version</key><integer>100000</integer><key>$objects</key><array><string>$null</string><integer>' + digits + '</integer></array><key>$top</key><dict><key>root</key><dict><key>CF$UID</key><integer>1</integer></dict></dict></dict></plist>')
PY
node scripts/rea.mjs inspect-keyed-archive large-integer.plist --json

Executed on an isolated baseline checkout at the stated commit. The observed object value and non-finite-real limitation are above; the full result retained the integer's original source digest and object index.

Expected behavior

If inspection accepts the input, preserve finite integer identity and exact digits or report an explicit unsupported/format outcome. Do not describe an integer overflow in the decoder as an observed non-finite real in the source.

Impact and scope

Supported for this synthetic accepted input only. Native /usr/bin/plutil -p rejects the same bytes with Integer overflow in <integer>; this report does not claim that a 401-digit integer is supported by Apple's plist format. Occurrence in real application archives is NOT_ENOUGH_INFO. No target or disassembler was executed.

REA version

6.5.0 source at 78cf6100f33ad2412c0a3d60b83f8a44a43fbbb5.

Runtime and platform

Node 24.18.0, npm 11.16.0, macOS arm64. Other platforms unverified.

Target and artifact context

Self-authored shallow XML NSKeyedArchiver archive; one integer and one root UID. No application target.

Interface and earliest failure stage

Built CLI; XML value interpretation before Evidence projection. MCP baseline reproduction was not run for this case.

Relevant output or evidence

objects[1]: id:1, kind:"scalar", status:"observed", value:{"$plist_type":"real","value":null}. Limitation: 1 non-finite real value(s) despite the <integer> element.

Typed outcome or recovery expected

Keep integer identity through projection or refuse the unsupported integer explicitly. Retain references and source digests. Do not run or rewrite a target.

Analysis or suspected cause

Source-derived: the number-only XML decoder overflows to Infinity, then projectPlistValue wraps the non-finite Number as a real before exact-number metadata can restore integer type. #3373 and #4042 concern the same owning boundary; #4295 fixes generated scalar identity, but cannot recover integer provenance already erased at decoding.

Additional context

Found while auditing the shared numeric producer and consumers. A small local refactor is in progress, with exact integer retention at that boundary and separate native compatibility limitations. Prepared with AI assistance; observations above were executed locally.

Originally created by @morluto on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4789 ### Before submitting - [x] I searched open and closed issues for a related report. - [x] This uses self-authored input without credentials or sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior At `78cf6100f`, the built CLI accepts a shallow XML keyed archive containing the finite integer `1` followed by 400 zeros, exits 0, and reports object 1 as an observed scalar with `{"$plist_type":"real","value":null}`. A limitation then claims one non-finite real was present. The source element is an integer, not a real. ### Reproduction After `npm run build:cached`, create this inert fixture and inspect it: ```sh python3 - <<'PY' from pathlib import Path digits = '1' + '0' * 400 Path('large-integer.plist').write_text('<plist><dict><key>$archiver</key><string>NSKeyedArchiver</string><key>$version</key><integer>100000</integer><key>$objects</key><array><string>$null</string><integer>' + digits + '</integer></array><key>$top</key><dict><key>root</key><dict><key>CF$UID</key><integer>1</integer></dict></dict></dict></plist>') PY node scripts/rea.mjs inspect-keyed-archive large-integer.plist --json ``` Executed on an isolated baseline checkout at the stated commit. The observed object value and non-finite-real limitation are above; the full result retained the integer's original source digest and object index. ### Expected behavior If inspection accepts the input, preserve finite integer identity and exact digits or report an explicit unsupported/format outcome. Do not describe an integer overflow in the decoder as an observed non-finite real in the source. ### Impact and scope Supported for this synthetic accepted input only. Native `/usr/bin/plutil -p` rejects the same bytes with `Integer overflow in <integer>`; this report does **not** claim that a 401-digit integer is supported by Apple's plist format. Occurrence in real application archives is **NOT_ENOUGH_INFO**. No target or disassembler was executed. ### REA version 6.5.0 source at `78cf6100f33ad2412c0a3d60b83f8a44a43fbbb5`. ### Runtime and platform Node 24.18.0, npm 11.16.0, macOS arm64. Other platforms unverified. ### Target and artifact context Self-authored shallow XML NSKeyedArchiver archive; one integer and one root UID. No application target. ### Interface and earliest failure stage Built CLI; XML value interpretation before Evidence projection. MCP baseline reproduction was not run for this case. ### Relevant output or evidence `objects[1]`: `id:1`, `kind:"scalar"`, `status:"observed"`, `value:{"$plist_type":"real","value":null}`. Limitation: `1 non-finite real value(s)` despite the `<integer>` element. ### Typed outcome or recovery expected Keep integer identity through projection or refuse the unsupported integer explicitly. Retain references and source digests. Do not run or rewrite a target. ### Analysis or suspected cause Source-derived: the number-only XML decoder overflows to Infinity, then `projectPlistValue` wraps the non-finite Number as a real before exact-number metadata can restore integer type. #3373 and #4042 concern the same owning boundary; #4295 fixes generated scalar identity, but cannot recover integer provenance already erased at decoding. ### Additional context Found while auditing the shared numeric producer and consumers. A small local refactor is in progress, with exact integer retention at that boundary and separate native compatibility limitations. Prepared with AI assistance; observations above were executed locally.

bsakaguchi

2026-10-17 21:05:39 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-17 21:05:42 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Fixed on main in 7aa4b98c9.

The shared boundary now interprets values and number facts together from the validated, depth-bounded XML DOM. Hexadecimal integers retain their value; real text and CDATA are combined. Keyed archives, Interface Builder and native plist projections consume those parsed facts. The second XML parse, key aliases/source-location rewriting, artifact XML scanner and native private XML scanner were removed. Source bytes, digests, references, scalar identity, prototype omissions and unsupported mixed-integer limitations remain covered.

Adapted @apitoagents's relevant hexadecimal regression and literal-parsing proposal from #3475. Executed native plutil controls established valid signed-hex and real-CDATA cases; native binary conversion independently confirmed the updated real-value expectations. Native plutil rejects the synthetic 401-digit integer overflow input in #4789: preserving exact integer identity for REA's accepted input does not claim native-format support. A source-only native JSON metadata collision control was also repaired; this does not claim plutil emits CDATA in its canonical conversion output.

Validation: 274 focused checks passed across 30 files, one skipped; build, check:fast, docs:check and commit/push hooks passed. New built CLI/actual stdio MCP numeric controls failed eight baseline checks before the fix. Source golden, exact-number, UID/reference, pagination, malformed-XML, depth, prototype and shared-consumer controls passed. Two read-only reviews are clear after fixing the newly reported overflow provenance gap.

48 small completed CLI comparisons covered keyed XML/binary and native inspect-plist safe/JSON-unsafe/XML-unsafe workflows. Ordinary keyed and all three native full replies and Evidence IDs stayed byte for byte equal. Recorded full-reply token estimates, elapsed and wait4 CPU time, OS process peak and sampled process-family memory, separating first and repeated processes. No statistical speed claim; subprocess CPU inclusion and short-lived memory peaks have measurement limits. Whole-agent/catalog/MCP, large-input and failure costs remain unmeasured. No heavy profiler, investigated-target execution or real deep-provider verification.

@morluto commented on GitHub (Oct 17, 2026): Fixed on main in 7aa4b98c9. The shared boundary now interprets values and number facts together from the validated, depth-bounded XML DOM. Hexadecimal integers retain their value; real text and CDATA are combined. Keyed archives, Interface Builder and native plist projections consume those parsed facts. The second XML parse, key aliases/source-location rewriting, artifact XML scanner and native private XML scanner were removed. Source bytes, digests, references, scalar identity, prototype omissions and unsupported mixed-integer limitations remain covered. Adapted @apitoagents's relevant hexadecimal regression and literal-parsing proposal from #3475. Executed native plutil controls established valid signed-hex and real-CDATA cases; native binary conversion independently confirmed the updated real-value expectations. Native plutil rejects the synthetic 401-digit integer overflow input in #4789: preserving exact integer identity for REA's accepted input does not claim native-format support. A source-only native JSON metadata collision control was also repaired; this does not claim plutil emits CDATA in its canonical conversion output. Validation: 274 focused checks passed across 30 files, one skipped; build, check:fast, docs:check and commit/push hooks passed. New built CLI/actual stdio MCP numeric controls failed eight baseline checks before the fix. Source golden, exact-number, UID/reference, pagination, malformed-XML, depth, prototype and shared-consumer controls passed. Two read-only reviews are clear after fixing the newly reported overflow provenance gap. 48 small completed CLI comparisons covered keyed XML/binary and native inspect-plist safe/JSON-unsafe/XML-unsafe workflows. Ordinary keyed and all three native full replies and Evidence IDs stayed byte for byte equal. Recorded full-reply token estimates, elapsed and wait4 CPU time, OS process peak and sampled process-family memory, separating first and repeated processes. No statistical speed claim; subprocess CPU inclusion and short-lived memory peaks have measurement limits. Whole-agent/catalog/MCP, large-input and failure costs remain unmeasured. No heavy profiler, investigated-target execution or real deep-provider verification.

bsakaguchi referenced this issue

2026-10-31 01:05:19 +00:00

[PR #2491] [MERGED] fix(browser): preserve unknown storage inventory and fingerprint coverage #5269

bsakaguchi referenced this issue

2026-10-31 01:05:53 +00:00

[PR #2724] [MERGED] fix(artifacts): bound expanded ASAR listing before allocation #5345

bsakaguchi referenced this issue

2026-10-31 01:06:42 +00:00

[PR #2861] [MERGED] fix(browser): report complete storage key inventory changes #5446