morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2697] [MERGED] fix(dotnet): name the instruction when a CIL operand leaves the method body #5321

New issue

Closed

opened 2026-10-31 01:05:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:05:43 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2697
Author: @kaoru0822-kitauji
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/issue-2677

📝 Commits (4)

cf55856 fix(dotnet): name the instruction when a CIL operand leaves the method body
5b85ddc Merge remote-tracking branch 'origin/main' into fix/issue-2677
79c8192 Merge remote-tracking branch 'origin/main' into fix/issue-2677
5e097a0 Merge remote-tracking branch 'origin/main' into fix/issue-2677

📊 Changes

2 files changed (+64 additions, -2 deletions)

View changed files

📝 src/dotnet/ManagedCilDecoding.test.ts (+38 -0)
📝 src/dotnet/ManagedMemberInstructionDecoder.ts (+26 -2)

📄 Description

Fixes #2677.

Problem

decodeInstructions (src/dotnet/ManagedMemberInstructionDecoder.ts) already has a format diagnostic, Instruction X at IL offset N leaves method body, for an operand whose computed end passes the IL body. That check only runs after readOperand returns. The operand readers use Buffer#readInt8/readInt32LE/readUInt32LE/…, so when the bytes are cut off by the end of the body, the read itself throws RangeError. The decoder's catch-all then stores Node's message as body.issue:

{"status":"malformed","decoded_instruction_count":0,"issue":"Attempt to access memory outside buffer bounds","coverage":"partial"}

This happens for ldc.i4 with no operand. Short branches and 2-byte variable operands give an offset RangeError instead, and so does switch without its count. A body whose last byte is the 0xFE two-byte-opcode prefix fails the same way at the second opcode read.

Fix

readOperandWithin wraps readOperand. A RangeError means the operand leaves the body, so it returns undefined, which goes to the existing leaves method body diagnostic. Any other error is rethrown unchanged.
The second byte of a two-byte opcode is bounds-checked before reading. The message is Two-byte CIL opcode at IL offset N leaves method body.

Malformed status, partial coverage, earlier decoded instructions and the null normalized-IL hash are unchanged. Complete bodies decode as before.

Validation

New ManagedCilDecoding.test.ts > managed CIL truncated operands cases run through inspectManagedMembersBytes on an owned PE/CLI fixture with tiny method bodies:

IL	issue
`ldc.i4`	`Instruction ldc.i4 at IL offset 0 leaves method body`
`nop; ldc.i4 <1 byte>`	offset 1, one instruction preserved
`br.s`	`Instruction br.s at IL offset 0 …`
`switch` with a partial count	`Instruction switch at IL offset 0 …`
`ldarg` (0xFE 0x09) with a partial operand	`Instruction ldarg at IL offset 0 …`
`nop; 0xFE`	`Two-byte CIL opcode at IL offset 1 leaves method body`

All six fail on main and pass here. They also assert status: malformed, the decoded count and coverage: partial.

All src/dotnet tests pass (11 files, 189 tests). npm run check:fast and format:check pass.

Note: main's CI is currently red for unrelated reasons (jscpd at 3.01% against a 3.0% threshold, and IdaWorkspaceThinning.test.ts), both reproducible on clean main.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2697 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/issue-2677` --- ### 📝 Commits (4) - [`cf55856`](https://github.com/morluto/rea/commit/cf55856392b4cfece29ca398982543fe01cf9634) fix(dotnet): name the instruction when a CIL operand leaves the method body - [`5b85ddc`](https://github.com/morluto/rea/commit/5b85ddceadb8a5d1c5fcc6ba0da86276e39685d4) Merge remote-tracking branch 'origin/main' into fix/issue-2677 - [`79c8192`](https://github.com/morluto/rea/commit/79c81923a0d339c39903b99e7ec844621d9cc378) Merge remote-tracking branch 'origin/main' into fix/issue-2677 - [`5e097a0`](https://github.com/morluto/rea/commit/5e097a0e0217ed9fcde11c35f74b52b6e2a768a7) Merge remote-tracking branch 'origin/main' into fix/issue-2677 ### 📊 Changes **2 files changed** (+64 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/dotnet/ManagedCilDecoding.test.ts` (+38 -0) 📝 `src/dotnet/ManagedMemberInstructionDecoder.ts` (+26 -2) </details> ### 📄 Description Fixes #2677. ## Problem `decodeInstructions` (`src/dotnet/ManagedMemberInstructionDecoder.ts`) already has a format diagnostic, `Instruction X at IL offset N leaves method body`, for an operand whose computed end passes the IL body. That check only runs after `readOperand` returns. The operand readers use `Buffer#readInt8`/`readInt32LE`/`readUInt32LE`/…, so when the bytes are cut off by the end of the body, the read itself throws `RangeError`. The decoder's catch-all then stores Node's message as `body.issue`: ```json {"status":"malformed","decoded_instruction_count":0,"issue":"Attempt to access memory outside buffer bounds","coverage":"partial"} ``` This happens for `ldc.i4` with no operand. Short branches and 2-byte variable operands give an offset `RangeError` instead, and so does `switch` without its count. A body whose last byte is the `0xFE` two-byte-opcode prefix fails the same way at the second opcode read. ## Fix - `readOperandWithin` wraps `readOperand`. A `RangeError` means the operand leaves the body, so it returns `undefined`, which goes to the existing `leaves method body` diagnostic. Any other error is rethrown unchanged. - The second byte of a two-byte opcode is bounds-checked before reading. The message is `Two-byte CIL opcode at IL offset N leaves method body`. Malformed status, partial coverage, earlier decoded instructions and the null normalized-IL hash are unchanged. Complete bodies decode as before. ## Validation - New `ManagedCilDecoding.test.ts > managed CIL truncated operands` cases run through `inspectManagedMembersBytes` on an owned PE/CLI fixture with tiny method bodies: | IL | issue | | --- | --- | | `ldc.i4` | `Instruction ldc.i4 at IL offset 0 leaves method body` | | `nop; ldc.i4 <1 byte>` | offset 1, one instruction preserved | | `br.s` | `Instruction br.s at IL offset 0 …` | | `switch` with a partial count | `Instruction switch at IL offset 0 …` | | `ldarg` (0xFE 0x09) with a partial operand | `Instruction ldarg at IL offset 0 …` | | `nop; 0xFE` | `Two-byte CIL opcode at IL offset 1 leaves method body` | All six fail on main and pass here. They also assert `status: malformed`, the decoded count and `coverage: partial`. - All `src/dotnet` tests pass (11 files, 189 tests). `npm run check:fast` and `format:check` pass. Note: main's CI is currently red for unrelated reasons (`jscpd` at 3.01% against a 3.0% threshold, and `IdaWorkspaceThinning.test.ts`), both reproducible on clean main. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:05:43 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:43:45 +00:00

[PR #5321] [CLOSED] fix(artifacts): note legacy code page readings of unflagged ZIP names #6878

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5321

No description provided.

Rows
Columns