[GH-ISSUE #6734] [Bug] ELF extended-numbering refusal labels a valid image as invalid input #4097

New issue

Closed

opened 2026-10-31 00:46:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:46:48 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6734

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

An ELF64 relocatable image with a valid extended section count is rejected by ElfNotesProvider.inspect as invalid_request, category invalid_input, with issue path / invalid_format. Its recovery says to read the CLI/schema, correct the fields and retry. The underlying reason is instead the documented unsupported extended-numbering profile. GNU readelf reads the same image and its GNU build ID successfully.

This was observed through the production provider and shared error projection, without running the CLI or MCP transport.

Reproduction

From the source checkout with locked dependencies installed, create this synthetic ELF (4,178,432 bytes):

from pathlib import Path
import struct
n = 0xff00
b = bytearray(0x200 + 64*n)
b[:16] = b'\x7fELF\x02\x01\x01' + bytes(9)
struct.pack_into('<HHIQQQIHHHHHH', b, 16,
                 1, 62, 1, 0, 0, 0x200, 0, 64, 56, 0, 64, 0, 2)
struct.pack_into('<Q', b, 0x200 + 32, n)
note = struct.pack('<III', 4, 4, 3) + b'GNU\0' + bytes.fromhex('12345678')
b[0x100:0x100+len(note)] = note
names = b'\0.note.gnu.build-id\0.shstrtab\0'
b[0x180:0x180+len(names)] = names
struct.pack_into('<IIQQQQIIQQ', b, 0x240,
                 1, 7, 0, 0, 0x100, len(note), 0, 0, 4, 0)
struct.pack_into('<IIQQQQIIQQ', b, 0x280,
                 19, 3, 0, 0, 0x180, len(names), 0, 0, 1, 0)
Path('extended-count.elf').write_bytes(b)

Run readelf --file-header --notes extended-count.elf. Then call the production provider with the absolute fixture path, using the same harness as the observation:

node --import tsx --input-type=module -e '
import { resolve } from "node:path";
import { ElfNotesProvider } from "./src/native/elf/ElfNotesProvider.ts";
import { inspectElfNotesInputSchema } from "./src/domain/native/elfNotes.ts";
import { projectAnalysisError } from "./src/domain/analysisErrorProjection.ts";
const provider = new ElfNotesProvider();
try {
  const result = await provider.inspect(inspectElfNotesInputSchema.parse({
    path: resolve("extended-count.elf")
  }));
  console.log(JSON.stringify(result.ok ? result : projectAnalysisError(result.error), null, 2));
} finally { await provider.close(); }
'

One provider-boundary execution reproduced the incorrect classification. No target code was executed.

Expected behavior

Return a typed unsupported-target/profile outcome with recovery explaining the unsupported numbering. Do not mark the caller's valid file or schema fields malformed. The ELF notes guide explicitly calls extended numbering unsupported; this report does not request implementing it.

Impact and scope

Agents cannot distinguish a valid, unsupported ELF profile from malformed input using the advertised error category/recovery. Following the recovery cannot make this valid input supported. Verified only for the reduced extended-section-count ELF64 fixture; other extended-numbering forms and transport behavior were not tested. The explanatory detail does mention the actual limitation.

REA version

Source 76b56957e94d804667f7890b244639ecc4725b32 (package version 6.7.0). This operation is absent from the latest published rea-agents-6.7.0 tag; the finding concerns current main.

Runtime and platform

Node.js 24.22.1; Linux 7.2.8-9-omarchy x86_64; GNU readelf 2.47.

Target and artifact context

Synthetic ELF64 little-endian x86-64 relocatable image; 65,280 section headers, count in section zero, one GNU build-ID note.

Interface

Other

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

readelf reported Number of section headers: 0 (65280) and Build ID: 12345678 without an error. The production provider/error projection returned:

{
  "code": "invalid_request",
  "category": "invalid_input",
  "retryable": false,
  "recovery": {"kind": "inspect_input_contract", "operation": "inspect_elf_notes"},
  "details": {
    "operation": "inspect_elf_notes",
    "issues": [{"path": ["path"], "reason": "invalid_format", "message": "ELF extended numbering is unsupported."}]
  }
}

The remediation says: Correct the listed fields, then retry. Do not repeat the unchanged call.

Typed outcome or recovery expected

unsupported_target with the extended-numbering limitation, rather than input-contract recovery.

Analysis or suspected cause

Source-derived: the parser routes this unsupported profile through fail, which creates an ArtifactReaderFailure("format"). The provider converts it to AnalysisInputError.

Additional context

No fix or transport test was performed. The fixture and provider harness are local source-level evidence.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A valid unsupported image receives an incorrect actionable error classification and schema-repair instruction, preventing reliable automated recovery for that input profile.
Workaround status: available
Workaround basis: The detailed issue message still identifies extended numbering as unsupported; a caller can inspect that message and use another ELF reader, as demonstrated by readelf.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6734 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior An ELF64 relocatable image with a valid extended section count is rejected by `ElfNotesProvider.inspect` as `invalid_request`, category `invalid_input`, with issue `path / invalid_format`. Its recovery says to read the CLI/schema, correct the fields and retry. The underlying reason is instead the documented unsupported extended-numbering profile. GNU `readelf` reads the same image and its GNU build ID successfully. This was observed through the production provider and shared error projection, without running the CLI or MCP transport. ### Reproduction From the source checkout with locked dependencies installed, create this synthetic ELF (4,178,432 bytes): ```python from pathlib import Path import struct n = 0xff00 b = bytearray(0x200 + 64*n) b[:16] = b'\x7fELF\x02\x01\x01' + bytes(9) struct.pack_into('<HHIQQQIHHHHHH', b, 16, 1, 62, 1, 0, 0, 0x200, 0, 64, 56, 0, 64, 0, 2) struct.pack_into('<Q', b, 0x200 + 32, n) note = struct.pack('<III', 4, 4, 3) + b'GNU\0' + bytes.fromhex('12345678') b[0x100:0x100+len(note)] = note names = b'\0.note.gnu.build-id\0.shstrtab\0' b[0x180:0x180+len(names)] = names struct.pack_into('<IIQQQQIIQQ', b, 0x240, 1, 7, 0, 0, 0x100, len(note), 0, 0, 4, 0) struct.pack_into('<IIQQQQIIQQ', b, 0x280, 19, 3, 0, 0, 0x180, len(names), 0, 0, 1, 0) Path('extended-count.elf').write_bytes(b) ``` Run `readelf --file-header --notes extended-count.elf`. Then call the production provider with the absolute fixture path, using the same harness as the observation: ```sh node --import tsx --input-type=module -e ' import { resolve } from "node:path"; import { ElfNotesProvider } from "./src/native/elf/ElfNotesProvider.ts"; import { inspectElfNotesInputSchema } from "./src/domain/native/elfNotes.ts"; import { projectAnalysisError } from "./src/domain/analysisErrorProjection.ts"; const provider = new ElfNotesProvider(); try { const result = await provider.inspect(inspectElfNotesInputSchema.parse({ path: resolve("extended-count.elf") })); console.log(JSON.stringify(result.ok ? result : projectAnalysisError(result.error), null, 2)); } finally { await provider.close(); } ' ``` One provider-boundary execution reproduced the incorrect classification. No target code was executed. ### Expected behavior Return a typed unsupported-target/profile outcome with recovery explaining the unsupported numbering. Do not mark the caller's valid file or schema fields malformed. [The ELF notes guide](https://github.com/morluto/rea/blob/76b56957e94d804667f7890b244639ecc4725b32/docs/elf-notes.md#L42-L51) explicitly calls extended numbering unsupported; this report does not request implementing it. ### Impact and scope Agents cannot distinguish a valid, unsupported ELF profile from malformed input using the advertised error category/recovery. Following the recovery cannot make this valid input supported. Verified only for the reduced extended-section-count ELF64 fixture; other extended-numbering forms and transport behavior were not tested. The explanatory detail does mention the actual limitation. ### REA version Source `76b56957e94d804667f7890b244639ecc4725b32` (package version 6.7.0). This operation is absent from the latest published `rea-agents-6.7.0` tag; the finding concerns current main. ### Runtime and platform Node.js 24.22.1; Linux 7.2.8-9-omarchy x86_64; GNU readelf 2.47. ### Target and artifact context Synthetic ELF64 little-endian x86-64 relocatable image; 65,280 section headers, count in section zero, one GNU build-ID note. ### Interface Other ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence `readelf` reported `Number of section headers: 0 (65280)` and `Build ID: 12345678` without an error. The production provider/error projection returned: ```json { "code": "invalid_request", "category": "invalid_input", "retryable": false, "recovery": {"kind": "inspect_input_contract", "operation": "inspect_elf_notes"}, "details": { "operation": "inspect_elf_notes", "issues": [{"path": ["path"], "reason": "invalid_format", "message": "ELF extended numbering is unsupported."}] } } ``` The remediation says: `Correct the listed fields, then retry. Do not repeat the unchanged call.` ### Typed outcome or recovery expected `unsupported_target` with the extended-numbering limitation, rather than input-contract recovery. ### Analysis or suspected cause Source-derived: [the parser](https://github.com/morluto/rea/blob/76b56957e94d804667f7890b244639ecc4725b32/src/native/elf/ElfNoteParser.ts#L299-L306) routes this unsupported profile through `fail`, which creates an `ArtifactReaderFailure("format")`. [The provider](https://github.com/morluto/rea/blob/76b56957e94d804667f7890b244639ecc4725b32/src/native/elf/ElfNotesProvider.ts#L148-L155) converts it to `AnalysisInputError`. ### Additional context No fix or transport test was performed. The fixture and provider harness are local source-level evidence. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A valid unsupported image receives an incorrect actionable error classification and schema-repair instruction, preventing reliable automated recovery for that input profile. - Workaround status: available - Workaround basis: The detailed issue message still identifies extended numbering as unsupported; a caller can inspect that message and use another ELF reader, as demonstrated by readelf.

bsakaguchi closed this issue

2026-10-31 00:46:48 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:30 +00:00

[PR #4097] [MERGED] feat(javascript): add filtered retained module reference views #6055