[GH-ISSUE #6482] [Bug] inspect-byte-entropy blames length for an out-of-range offset #3887

New issue

Closed

opened 2026-10-31 00:44:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:44:57 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6482

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

On a 1,024-byte file, inspect-byte-entropy --offset 2048 --json correctly refuses the window but identifies ["length"] as the rejected argument, although length was omitted. Its remediation says to correct the listed fields. Adding --length 0 leaves the same error; reducing the offset to 512 succeeds. The defect is the correction field, not the refusal.

Reproduction

Use the built source checkout and pinned Node toolchain listed below. Run from its root after preparing the runtime as described in CONTRIBUTING. Verification used the existing baseline build; dependency installation and a new build were not performed. These commands generate all input locally and give REA a clean environment with disposable home, config, cache, state and temporary directories.

node_bin="$(node -p process.execPath)"
work_dir="$(mktemp -d)"
mkdir -p "$work_dir/home" "$work_dir/config" "$work_dir/cache" \
    "$work_dir/data" "$work_dir/state" "$work_dir/temp" \
    "$work_dir/dsh" "$work_dir/dsh-agents"
python3 -c 'import sys; sys.stdout.buffer.write(bytes(range(256)) * 4)' \
    > "$work_dir/window.bin"
run_rea() {
  env -i PATH="$(dirname "$node_bin"):/usr/bin:/bin" \
    HOME="$work_dir/home" XDG_CONFIG_HOME="$work_dir/config" \
    XDG_CACHE_HOME="$work_dir/cache" XDG_DATA_HOME="$work_dir/data" \
    XDG_STATE_HOME="$work_dir/state" TMPDIR="$work_dir/temp" \
    DSH_HOME="$work_dir/dsh" DSH_AGENTS_HOME="$work_dir/dsh-agents" \
    REA_LOG_LEVEL=silent NO_COLOR=1 "$node_bin" scripts/rea.mjs \
    inspect-byte-entropy "$work_dir/window.bin" "$@" --json
  result_status=$?
  printf 'exit=%s\n' "$result_status"
}
run_rea --offset 2048
run_rea --offset 1024
run_rea --offset 512 --length 1024
run_rea --offset 2048 --length 0
run_rea --offset 512

The initial independent probe reproduced the offset-only error twice in two attempts, executed all four controls above, and also verified successful whole-file inspection. The inline commands were replayed separately with the same results. All REA invocations had empty stderr.

Expected behavior

For a window starting beyond EOF, identify offset as the invalid caller argument when length is omitted. Continue rejecting the request. Preserve acceptance of an empty window at EOF and attribution to length when a valid offset is paired with an explicitly overlong length. Correction metadata should identify the argument whose change can resolve the refusal.

Impact and scope

P3 diagnostic defect: the invalid window is rejected correctly, but its correction metadata points to an omitted field. No wrong successful analysis, data loss, or actual downstream automated-repair failure was observed. The verified workaround is to reduce the offset to an in-file position; offset 512 returns a 512-byte window on this fixture. Runtime observations cover the CLI and cases below on one host. The service branch also explains the same attribution for other stable regular files whose offset exceeds their size; that wider reach is source-derived, not a platform matrix.

REA version

Source revision 6dff37594c0bc942c9748b34a7a028d223e88a6d, package 6.7.0.

Runtime and platform

Node.js v24.18.0; npm 11.16.0; macOS 27.0.1 arm64. The CLI used its prepared compiled runtime and locked dependencies. No native analysis engine or target application was launched.

Target and artifact context

A generated regular file containing byte values 0 through 255 repeated four times, totaling 1,024 bytes. The file is read as data and is not executed.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Expected source: docs/binary-diagnostics.md:251-260 defines offset selection, omitted length extending to EOF, rejection past EOF and acceptance of empty windows; src/cli/binaryDiagnosticsCommands.ts:75-80 exposes those selectors; src/domain/analysisErrorCore.ts:122-136 defines input issues as correction metadata for rejected caller arguments, and src/domain/analysisErrorPresentation.ts:156-157 directs callers to correct the listed fields.
Failure source: Independently executed public CLI calls on the synthetic fixture return the length issue below for omitted length and offset 2048; src/application/binaryDiagnostics/ByteEntropyService.ts:205-210 locates the combined file-bound check, and src/domain/analysisErrorProjection.ts:343-355 preserves its issue path in the public diagnostic.
Evidence provenance: observed; public CLI stdout, stderr and exit status establish the violation. The branch explanation and wider input reach are source-derived.
Local verification: reproduced.
Reproduction completeness: complete.

Relevant fields of the observed failing document:

{
  "code": "invalid_request",
  "category": "invalid_input",
  "retryable": false,
  "recovery": {
    "kind": "inspect_input_contract",
    "operation": "inspect_byte_entropy"
  },
  "details": {
    "operation": "inspect_byte_entropy",
    "issues": [{
      "path": ["length"],
      "reason": "invalid_value",
      "message": "Selected byte window extends beyond the end of the file."
    }]
  }
}

The accompanying remediation says: Correct the listed fields, then retry. Do not repeat the unchanged call.

Request selectors	Exit	Observed result
offset 2048; length omitted	1	The length issue above
offset 1024; length omitted	0	window {"offset":1024,"length":0}, blocks []
offset 512; length 1024	1	Same length issue, correctly naming the overlong supplied length
offset 2048; length 0	1	Same length issue despite reducing length to zero
offset 512; length omitted	0	window {"offset":512,"length":512}, one block of entropy 8

Restoration check

On the same fixture, the offset-2048 request with omitted length should still exit 1 with invalid_request, but identify ["offset"] in its correction issues. Changing only length to zero cannot make that offset valid and should not misidentify length as the offending selector. Keep the offset-at-EOF empty-window success, correct ["length"] attribution for offset 512 with length 1024, and successful offset-512 request. These controls distinguish correct field attribution from changing the accepted window contract or indiscriminately naming offset for every overflow.

Typed outcome or recovery expected

Keep the invalid-input result and input-contract recovery, with a correction issue naming the out-of-file offset. A caller should be able to correct that named selector and retry successfully.

Analysis or suspected cause

Source-derived: the service computes the omitted length from file size minus offset, then uses one rejection branch for both an offset beyond the file and a length extending beyond the remaining bytes. The branch supplies the constant field name length. This accounts for the observed result without requiring a change to window acceptance semantics. The implementation and test design remain open.

Additional context

Open and closed duplicate searches covered command spellings, the service name, entropy, byte windows, issue paths and correction guidance. Related reports #5877, #6041, #6119 and #6473 concern firmware path prefixes, V8 role attribution, environment payload validation and missing objdump selector issues respectively; restoring those behaviors would leave this file-window diagnostic unchanged. No matching report was found. MCP and other operating systems were not executed. No introducing revision or last known good revision was established.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: The observed defect is misleading correction metadata on correctly refused inputs; valid analysis still succeeds, and no consequential downstream client failure or corrupted result was observed.
Workaround status: available
Workaround basis: Reducing the offset to 512 on the same unchanged fixture succeeds and returns the expected 512-byte window without any code or configuration change.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6482 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area CLI ## Observed behavior On a 1,024-byte file, `inspect-byte-entropy --offset 2048 --json` correctly refuses the window but identifies `["length"]` as the rejected argument, although length was omitted. Its remediation says to correct the listed fields. Adding `--length 0` leaves the same error; reducing the offset to 512 succeeds. The defect is the correction field, not the refusal. ## Reproduction Use the built source checkout and pinned Node toolchain listed below. Run from its root after preparing the runtime as described in CONTRIBUTING. Verification used the existing baseline build; dependency installation and a new build were not performed. These commands generate all input locally and give REA a clean environment with disposable home, config, cache, state and temporary directories. ```sh node_bin="$(node -p process.execPath)" work_dir="$(mktemp -d)" mkdir -p "$work_dir/home" "$work_dir/config" "$work_dir/cache" \ "$work_dir/data" "$work_dir/state" "$work_dir/temp" \ "$work_dir/dsh" "$work_dir/dsh-agents" python3 -c 'import sys; sys.stdout.buffer.write(bytes(range(256)) * 4)' \ > "$work_dir/window.bin" run_rea() { env -i PATH="$(dirname "$node_bin"):/usr/bin:/bin" \ HOME="$work_dir/home" XDG_CONFIG_HOME="$work_dir/config" \ XDG_CACHE_HOME="$work_dir/cache" XDG_DATA_HOME="$work_dir/data" \ XDG_STATE_HOME="$work_dir/state" TMPDIR="$work_dir/temp" \ DSH_HOME="$work_dir/dsh" DSH_AGENTS_HOME="$work_dir/dsh-agents" \ REA_LOG_LEVEL=silent NO_COLOR=1 "$node_bin" scripts/rea.mjs \ inspect-byte-entropy "$work_dir/window.bin" "$@" --json result_status=$? printf 'exit=%s\n' "$result_status" } run_rea --offset 2048 run_rea --offset 1024 run_rea --offset 512 --length 1024 run_rea --offset 2048 --length 0 run_rea --offset 512 ``` The initial independent probe reproduced the offset-only error twice in two attempts, executed all four controls above, and also verified successful whole-file inspection. The inline commands were replayed separately with the same results. All REA invocations had empty stderr. ## Expected behavior For a window starting beyond EOF, identify `offset` as the invalid caller argument when length is omitted. Continue rejecting the request. Preserve acceptance of an empty window at EOF and attribution to `length` when a valid offset is paired with an explicitly overlong length. Correction metadata should identify the argument whose change can resolve the refusal. ## Impact and scope P3 diagnostic defect: the invalid window is rejected correctly, but its correction metadata points to an omitted field. No wrong successful analysis, data loss, or actual downstream automated-repair failure was observed. The verified workaround is to reduce the offset to an in-file position; offset 512 returns a 512-byte window on this fixture. Runtime observations cover the CLI and cases below on one host. The service branch also explains the same attribution for other stable regular files whose offset exceeds their size; that wider reach is source-derived, not a platform matrix. ## REA version Source revision `6dff37594c0bc942c9748b34a7a028d223e88a6d`, package 6.7.0. ## Runtime and platform Node.js v24.18.0; npm 11.16.0; macOS 27.0.1 arm64. The CLI used its prepared compiled runtime and locked dependencies. No native analysis engine or target application was launched. ## Target and artifact context A generated regular file containing byte values 0 through 255 repeated four times, totaling 1,024 bytes. The file is read as data and is not executed. ## Interface CLI ## Earliest failure stage Request parsing or validation ## Relevant output or evidence - Expected source: `docs/binary-diagnostics.md:251-260` defines offset selection, omitted length extending to EOF, rejection past EOF and acceptance of empty windows; `src/cli/binaryDiagnosticsCommands.ts:75-80` exposes those selectors; `src/domain/analysisErrorCore.ts:122-136` defines input issues as correction metadata for rejected caller arguments, and `src/domain/analysisErrorPresentation.ts:156-157` directs callers to correct the listed fields. - Failure source: Independently executed public CLI calls on the synthetic fixture return the length issue below for omitted length and offset 2048; `src/application/binaryDiagnostics/ByteEntropyService.ts:205-210` locates the combined file-bound check, and `src/domain/analysisErrorProjection.ts:343-355` preserves its issue path in the public diagnostic. - Evidence provenance: observed; public CLI stdout, stderr and exit status establish the violation. The branch explanation and wider input reach are source-derived. - Local verification: reproduced. - Reproduction completeness: complete. Relevant fields of the observed failing document: ```json { "code": "invalid_request", "category": "invalid_input", "retryable": false, "recovery": { "kind": "inspect_input_contract", "operation": "inspect_byte_entropy" }, "details": { "operation": "inspect_byte_entropy", "issues": [{ "path": ["length"], "reason": "invalid_value", "message": "Selected byte window extends beyond the end of the file." }] } } ``` The accompanying remediation says: `Correct the listed fields, then retry. Do not repeat the unchanged call.` | Request selectors | Exit | Observed result | | --- | --- | --- | | offset 2048; length omitted | 1 | The length issue above | | offset 1024; length omitted | 0 | window {"offset":1024,"length":0}, blocks [] | | offset 512; length 1024 | 1 | Same length issue, correctly naming the overlong supplied length | | offset 2048; length 0 | 1 | Same length issue despite reducing length to zero | | offset 512; length omitted | 0 | window {"offset":512,"length":512}, one block of entropy 8 | ### Restoration check On the same fixture, the offset-2048 request with omitted length should still exit 1 with `invalid_request`, but identify `["offset"]` in its correction issues. Changing only length to zero cannot make that offset valid and should not misidentify length as the offending selector. Keep the offset-at-EOF empty-window success, correct `["length"]` attribution for offset 512 with length 1024, and successful offset-512 request. These controls distinguish correct field attribution from changing the accepted window contract or indiscriminately naming offset for every overflow. ## Typed outcome or recovery expected Keep the invalid-input result and input-contract recovery, with a correction issue naming the out-of-file offset. A caller should be able to correct that named selector and retry successfully. ## Analysis or suspected cause Source-derived: the service computes the omitted length from file size minus offset, then uses one rejection branch for both an offset beyond the file and a length extending beyond the remaining bytes. The branch supplies the constant field name `length`. This accounts for the observed result without requiring a change to window acceptance semantics. The implementation and test design remain open. ## Additional context Open and closed duplicate searches covered command spellings, the service name, entropy, byte windows, issue paths and correction guidance. Related reports [#5877](https://github.com/morluto/rea/issues/5877), [#6041](https://github.com/morluto/rea/issues/6041), [#6119](https://github.com/morluto/rea/issues/6119) and [#6473](https://github.com/morluto/rea/issues/6473) concern firmware path prefixes, V8 role attribution, environment payload validation and missing objdump selector issues respectively; restoring those behaviors would leave this file-window diagnostic unchanged. No matching report was found. MCP and other operating systems were not executed. No introducing revision or last known good revision was established. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: The observed defect is misleading correction metadata on correctly refused inputs; valid analysis still succeeds, and no consequential downstream client failure or corrupted result was observed. - Workaround status: available - Workaround basis: Reducing the offset to 512 on the same unchanged fixture succeeds and returns the expected 512-byte window without any code or configuration change.

bsakaguchi closed this issue

2026-10-31 00:44:57 +00:00

bsakaguchi referenced this issue

2026-10-31 01:13:11 +00:00

[PR #4486] [CLOSED] fix(cutter): admit bridge descriptors without blocking on pipes #6271