[GH-ISSUE #1499] fix(native): report pointer-fixup coverage from the commands actually read #515

Closed
opened 2026-10-15 18:25:46 +00:00 by bsakaguchi · 1 comment
Owner

Originally created by @cursor[bot] on GitHub (Oct 10, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1499

TL;DR: A Mach-O whose only dyld-info payload is rebase opcodes is reported as pointer_fixups complete with reason "no fixup load commands". The rebase stream is never read.

Area

Native Mach-O inspection

Observed behavior

collectFixupCommand records LC_DYLD_CHAINED_FIXUPS and the bind, weak-bind, and lazy-bind ranges of LC_DYLD_INFO / LC_DYLD_INFO_ONLY. The rebase range at command offset 8 is not recorded.

parsePointerFixups then does this when there is no chained fixup command and every recorded bind stream is empty:

  • kind: "none"
  • issues: []
  • every pointer decodes as { kind: "rebase", target: raw }

pushDispatchCoverage sets pointer_fixups to complete whenever issues is empty, with examined: 0 and decoded: 0. describeFixups for kind: "none" is the string "no fixup load commands".

A binary that has LC_DYLD_INFO with a non-empty rebase opcode stream and empty bind streams therefore claims fixup coverage is complete and that no fixup command was present. The Swift unsupported facet next to it uses status unsupported for a reader limit. This facet uses complete.

Expected behavior

Rebase opcodes should be part of the fixup observation, or the facet should say they were not decoded. pointer_fixups should be partial or unsupported when the examined count is zero or a dyld-info command was present and not fully read. The reason should name the command that was skipped.

Where

  • src/native/AppleMachoSelection.ts — collectFixupCommand
  • src/native/AppleMachoFixups.ts — parsePointerFixups
  • src/native/AppleDispatchCoverage.ts — pushDispatchCoverage, describeFixups
Originally created by @cursor[bot] on GitHub (Oct 10, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1499 **TL;DR:** A Mach-O whose only dyld-info payload is rebase opcodes is reported as `pointer_fixups` `complete` with reason "no fixup load commands". The rebase stream is never read. ### Area Native Mach-O inspection ### Observed behavior `collectFixupCommand` records `LC_DYLD_CHAINED_FIXUPS` and the bind, weak-bind, and lazy-bind ranges of `LC_DYLD_INFO` / `LC_DYLD_INFO_ONLY`. The rebase range at command offset 8 is not recorded. `parsePointerFixups` then does this when there is no chained fixup command and every recorded bind stream is empty: - `kind: "none"` - `issues: []` - every pointer decodes as `{ kind: "rebase", target: raw }` `pushDispatchCoverage` sets `pointer_fixups` to `complete` whenever `issues` is empty, with `examined: 0` and `decoded: 0`. `describeFixups` for `kind: "none"` is the string "no fixup load commands". A binary that has `LC_DYLD_INFO` with a non-empty rebase opcode stream and empty bind streams therefore claims fixup coverage is complete and that no fixup command was present. The Swift unsupported facet next to it uses status `unsupported` for a reader limit. This facet uses `complete`. ### Expected behavior Rebase opcodes should be part of the fixup observation, or the facet should say they were not decoded. `pointer_fixups` should be `partial` or `unsupported` when the examined count is zero or a dyld-info command was present and not fully read. The reason should name the command that was skipped. ### Where - `src/native/AppleMachoSelection.ts` — `collectFixupCommand` - `src/native/AppleMachoFixups.ts` — `parsePointerFixups` - `src/native/AppleDispatchCoverage.ts` — `pushDispatchCoverage`, `describeFixups`
bsakaguchi 2026-10-15 18:25:46 +00:00
Author
Owner

@morluto commented on GitHub (Oct 10, 2026):

Thanks for reporting this. Closing as resolved on main. The fixup reader records unread LC_DYLD_INFO rebase bytes, and pointer-fixup coverage reports those unread commands as partial rather than claiming complete coverage.

Merged fix. I checked the current source against this report; no tests or real-provider workflows were run for this closure pass.

<!-- gh-comment-id:6099801887 --> @morluto commented on GitHub (Oct 10, 2026): Thanks for reporting this. Closing as resolved on main. The fixup reader records unread LC_DYLD_INFO rebase bytes, and pointer-fixup coverage reports those unread commands as partial rather than claiming complete coverage. [Merged fix](https://github.com/morluto/rea/commit/b4db35f092d7166aebdf4387b48f7652b1d1c3b6). I checked the current source against this report; no tests or real-provider workflows were run for this closure pass.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#515
No description provided.