[PR #2334] [MERGED] fix(flutter): reject ambiguous ELF mappings and bound note reads #5170

New issue

Closed

opened 2026-10-31 01:04:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:04:31 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2334
Author: @3QL
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/flutter-post-merge-bounds

📝 Commits (4)

337b12e fix(flutter): reject ambiguous mappings and bound ELF notes
b9a8f24 Merge branch 'morluto:main' into fix/flutter-post-merge-bounds
212f3b1 fix(flutter): clean verifier files after shutdown failures
d31b96c test(flutter): parse complete facts through named result schemas

📊 Changes

10 files changed (+510 additions, -68 deletions)

View changed files

📝 docs/flutter-analysis.md (+15 -2)
📝 scripts/verify-flutter.mjs (+16 -14)
📝 src/flutter/DartElf.test.ts (+91 -0)
📝 src/flutter/DartElf.ts (+48 -44)
📝 src/flutter/ElfBuildId.ts (+18 -4)
➕ src/flutter/ElfLoadMap.ts (+101 -0)
📝 src/flutter/FlutterBuild.fixture.ts (+47 -0)
📝 tests/acceptance/flutterAnalysis.test.ts (+86 -0)
📝 tests/boundary/filesystem/flutterBuildProvider.test.ts (+9 -4)
➕ tests/boundary/filesystem/flutterElfNotes.test.ts (+79 -0)

📄 Description

Summary

Follow-up to #1582 addressing the two remaining ELF review findings.

Conflicting PT_LOAD mappings

The parser previously selected the first matching segment, potentially reporting complete coverage despite conflicting file interpretations.

Normalize load mappings once and reuse them for snapshot symbols, dynamic hash tables, dynsym and dynstr. Equivalent mappings remain valid; conflicting partial overlaps leave affected symbols unresolved while preserving other observations.

Unbounded ELF note ranges

The metadata byte budget did not bound the number of retained ranges or separate reads.

Limit the inventory to 1,024 distinct nonempty ranges before retention. Deduplicate shared ranges, skip empty ranges, and preserve examined build-ID candidates with partial coverage when the limit is exceeded.

Also correct shared verifier workspace ownership and structured Windows path assertions.

Validation

Validation of fix commit 337b12e34:

147 focused Flutter cases across Linux, macOS Sonoma 14.8.9 and Windows 11 build 26300.9457.
Real Gallery CLI/stdio MCP verification across all three ABIs, plus a plain-APK negative control.
Six compiler-produced ELF32/ELF64 SysV/GNU/both-hash cases.
Static, documentation, discovery and duplication checks passed.
Windows verification ran under a non-administrator account.

The 30,000-range fixture now requires at most 1,027 reads. An indicative CLI sample improved from 1.50s to 0.77s elapsed and 1.99s to 1.13s CPU. Peak process RSS changed from 333 to 324 MiB. OS caches were uncontrolled; token usage and summed process-family peak memory were not measured.

Full string-pool projections remain explicitly bounded.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2334 **Author:** [@3QL](https://github.com/3QL) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/flutter-post-merge-bounds` --- ### 📝 Commits (4) - [`337b12e`](https://github.com/morluto/rea/commit/337b12e34db81725dae82cc4bb04e84c48fd98a6) fix(flutter): reject ambiguous mappings and bound ELF notes - [`b9a8f24`](https://github.com/morluto/rea/commit/b9a8f242e71850e96f3a6fa118ada4bff750c592) Merge branch 'morluto:main' into fix/flutter-post-merge-bounds - [`212f3b1`](https://github.com/morluto/rea/commit/212f3b1b2903437c240da9d06f28d570bdf78ea9) fix(flutter): clean verifier files after shutdown failures - [`d31b96c`](https://github.com/morluto/rea/commit/d31b96cc05afa71529a0484a09e2fd4524b0e738) test(flutter): parse complete facts through named result schemas ### 📊 Changes **10 files changed** (+510 additions, -68 deletions) <details> <summary>View changed files</summary> 📝 `docs/flutter-analysis.md` (+15 -2) 📝 `scripts/verify-flutter.mjs` (+16 -14) 📝 `src/flutter/DartElf.test.ts` (+91 -0) 📝 `src/flutter/DartElf.ts` (+48 -44) 📝 `src/flutter/ElfBuildId.ts` (+18 -4) ➕ `src/flutter/ElfLoadMap.ts` (+101 -0) 📝 `src/flutter/FlutterBuild.fixture.ts` (+47 -0) 📝 `tests/acceptance/flutterAnalysis.test.ts` (+86 -0) 📝 `tests/boundary/filesystem/flutterBuildProvider.test.ts` (+9 -4) ➕ `tests/boundary/filesystem/flutterElfNotes.test.ts` (+79 -0) </details> ### 📄 Description ## Summary Follow-up to #1582 addressing the two remaining ELF review findings. ### Conflicting PT_LOAD mappings The parser previously selected the first matching segment, potentially reporting complete coverage despite conflicting file interpretations. Normalize load mappings once and reuse them for snapshot symbols, dynamic hash tables, dynsym and dynstr. Equivalent mappings remain valid; conflicting partial overlaps leave affected symbols unresolved while preserving other observations. ### Unbounded ELF note ranges The metadata byte budget did not bound the number of retained ranges or separate reads. Limit the inventory to 1,024 distinct nonempty ranges before retention. Deduplicate shared ranges, skip empty ranges, and preserve examined build-ID candidates with partial coverage when the limit is exceeded. Also correct shared verifier workspace ownership and structured Windows path assertions. ## Validation Validation of fix commit `337b12e34`: - 147 focused Flutter cases across Linux, macOS Sonoma 14.8.9 and Windows 11 build 26300.9457. - Real Gallery CLI/stdio MCP verification across all three ABIs, plus a plain-APK negative control. - Six compiler-produced ELF32/ELF64 SysV/GNU/both-hash cases. - Static, documentation, discovery and duplication checks passed. - Windows verification ran under a non-administrator account. The 30,000-range fixture now requires at most 1,027 reads. An indicative CLI sample improved from 1.50s to 0.77s elapsed and 1.99s to 1.13s CPU. Peak process RSS changed from 333 to 324 MiB. OS caches were uncontrolled; token usage and summed process-family peak memory were not measured. Full string-pool projections remain explicitly bounded. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:04:31 +00:00