morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #3859] [MERGED] fix(flutter): check section-backed symbol tables against PT_LOAD #5954

New issue

Closed

opened 2026-10-31 01:10:42 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:10:42 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3859
Author: @kaoru0822-kitauji
Created: 10/15/2026
Status: ✅ Merged
Merged: 10/15/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/dart-elf-section-table-mapping

📝 Commits (2)

ee8a97c fix(flutter): check section-backed symbol tables against PT_LOAD
b4f9f90 test(flutter): cover allocated ELF32 symbol-table mapping checks

📊 Changes

3 files changed (+191 additions, -0 deletions)

View changed files

📝 src/flutter/DartElf.test.ts (+101 -0)
📝 src/flutter/DartElf.ts (+33 -0)
📝 src/flutter/FlutterBuild.fixture.ts (+57 -0)

📄 Description

Summary

Fixes #3346. inspect-dart-aot reported complete coverage when a second PT_LOAD interpretation overlapped an allocated .dynsym or .dynstr section, so the metadata that selects the Dart snapshots was ambiguous. The same conflict over a snapshot payload already produced partial coverage, and docs/flutter-analysis.md says dynamic hash, symbol and string tables use the same mapping checks.

Now an allocated section-backed symbol or string table must have a single file-backed PT_LOAD interpretation that matches its section offset. Otherwise the symbol inventory is refused with the mapping reason, the same way the stripped PT_DYNAMIC path already treats its tables. With no recognizable snapshot selection left, inspect-dart-aot returns unsupported_target, which is one of the outcomes the issue lists as acceptable.

Problem and expected behavior

readElfSymbols in src/flutter/DartElf.ts has two paths:

Stripped path: maps DT_SYMTAB/DT_STRTAB/hash tables through the PT_LOAD map, and fails on has conflicting PT_LOAD mappings.
Section-backed path: read .dynsym and .dynstr only by sh_offset, without consulting the load map. A loader that reads those allocated tables through PT_LOAD can therefore see bytes that differ from the ones REA parsed.

Change and scope

New sectionMappingFailure(header, offset, size) in readElfSymbols, for SHF_ALLOC sections:
- maps sh_addr over the section size with the existing toOffset load map
- reports the load-map reason (conflicting or not file-backed)
- also reports a mapped offset that disagrees with sh_offset
It applies to the dynamic symbol table and its linked string table, and a failure refuses the inventory, matching the stripped path's table failures.
Non-allocated tables keep their section-offset reading, so existing fixtures and inputs without SHF_ALLOC are unchanged.
Not included: per-symbol partial recovery from a conflicting table. Every symbol depends on the table, so none can be established, and the stripped path also refuses in that case.

Contract and boundary impact

Semantic owner and earliest changed stage: ELF dynamic symbol-table admission (DartElf.ts).
Contribution scope fit and linked maintainer decision: correctness fix that implements the documented mapping checks; not applicable.
CLI and MCP/tool-catalog contract: schemas unchanged. Inputs with conflicting table metadata now fail with unsupported_target and a specific reason instead of returning complete coverage.
Provider, bridge, target-format, or platform compatibility: ELF32 and ELF64 section headers.
Evidence, artifact, provenance, or reconstruction contract: no completeness claim from ambiguous metadata.
Target selection, authority, upstream behavior, and cleanup details: unchanged.
Generated metadata, package, or installation impact: none; the docs already state this contract.

Expected effects:

Read existing files or captured data.

Evidence and regression coverage

Tests added in src/flutter/DartElf.test.ts, as a new allocated ELF symbol tables block:
- allocated tables with a consistent mapping still resolve
- a conflicting PT_LOAD over .dynsym and over .dynstr each refuse with Dynamic symbol table / Dynamic symbol string table has conflicting PT_LOAD mappings
- an sh_addr whose mapping disagrees with sh_offset refuses with section offset disagrees with its PT_LOAD mapping
Base reproduction: against the unfixed DartElf.ts, the three refusal cases fail (3 failed | 24 passed).

The issue's reproduction (built CLI, synthetic APKs), after:

control  coverage complete, 4 sections, 2 hash sources
symbols  unsupported_target: No recognizable Dart snapshot symbols were found: Dynamic symbol table has conflicting PT_LOAD mappings
strings  unsupported_target: No recognizable Dart snapshot symbols were found: Dynamic symbol string table has conflicting PT_LOAD mappings
snapshot coverage partial, 3 sections, 1 hash source (unchanged)

Before, symbols and strings reported coverage: complete with 4 sections.

Remaining proof gaps: no Flutter libapp.so was available locally.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:focused -- src/flutter/DartElf.test.ts tests/boundary/filesystem/flutterBuildProvider.test.ts tests/boundary/cli/flutterCli.test.ts tests/acceptance/flutterAnalysis.test.ts tests/boundary/mcp/dartAotSummaryMcp.test.ts: 128 passed before the new tests; src/flutter/DartElf.test.ts now passes 27
npm run check:fast: passed
Real ELF data. No Flutter libapp.so was available locally, so I used two real ARM ELF32 shared libraries from a production Android APK (libfftw3f.so, 677 KB; libanalysis.so, 14 KB).
- Both have allocated .dynsym/.dynstr (flags 0x2, address equal to offset), so the new check runs on them.
- The compiled readElfSymbols resolved every requested exported symbol listed by nm -D, with no failures, in 0.8–1.5 ms. Allocated tables in real libraries pass the new check.

Compatibility, safety, and release

Breaking changes or migration steps: none for well-formed ELF. Conflicting allocated table metadata is now refused instead of trusted.
Real Hopper/Ghidra, browser, or OS coverage: not applicable.
Package or release metadata impact: none.
Security, privacy, process, or containment review: none; parsing only.

Author readiness

Human owner:

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3859 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/15/2026 **Status:** ✅ Merged **Merged:** 10/15/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/dart-elf-section-table-mapping` --- ### 📝 Commits (2) - [`ee8a97c`](https://github.com/morluto/rea/commit/ee8a97cc99d2065b39a8246cfd4e1234698b1466) fix(flutter): check section-backed symbol tables against PT_LOAD - [`b4f9f90`](https://github.com/morluto/rea/commit/b4f9f90dbb9f9b3011228fc081451c072361ed1d) test(flutter): cover allocated ELF32 symbol-table mapping checks ### 📊 Changes **3 files changed** (+191 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `src/flutter/DartElf.test.ts` (+101 -0) 📝 `src/flutter/DartElf.ts` (+33 -0) 📝 `src/flutter/FlutterBuild.fixture.ts` (+57 -0) </details> ### 📄 Description ## Summary Fixes #3346. `inspect-dart-aot` reported complete coverage when a second `PT_LOAD` interpretation overlapped an allocated `.dynsym` or `.dynstr` section, so the metadata that selects the Dart snapshots was ambiguous. The same conflict over a snapshot payload already produced partial coverage, and `docs/flutter-analysis.md` says dynamic hash, symbol and string tables use the same mapping checks. Now an allocated section-backed symbol or string table must have a single file-backed `PT_LOAD` interpretation that matches its section offset. Otherwise the symbol inventory is refused with the mapping reason, the same way the stripped `PT_DYNAMIC` path already treats its tables. With no recognizable snapshot selection left, `inspect-dart-aot` returns `unsupported_target`, which is one of the outcomes the issue lists as acceptable. ## Problem and expected behavior `readElfSymbols` in `src/flutter/DartElf.ts` has two paths: - **Stripped path:** maps `DT_SYMTAB`/`DT_STRTAB`/hash tables through the `PT_LOAD` map, and fails on `has conflicting PT_LOAD mappings`. - **Section-backed path:** read `.dynsym` and `.dynstr` only by `sh_offset`, without consulting the load map. A loader that reads those allocated tables through `PT_LOAD` can therefore see bytes that differ from the ones REA parsed. ## Change and scope - New `sectionMappingFailure(header, offset, size)` in `readElfSymbols`, for `SHF_ALLOC` sections: - maps `sh_addr` over the section size with the existing `toOffset` load map - reports the load-map reason (conflicting or not file-backed) - also reports a mapped offset that disagrees with `sh_offset` - It applies to the dynamic symbol table and its linked string table, and a failure refuses the inventory, matching the stripped path's table failures. - Non-allocated tables keep their section-offset reading, so existing fixtures and inputs without `SHF_ALLOC` are unchanged. - Not included: per-symbol partial recovery from a conflicting table. Every symbol depends on the table, so none can be established, and the stripped path also refuses in that case. ## Contract and boundary impact - Semantic owner and earliest changed stage: ELF dynamic symbol-table admission (`DartElf.ts`). - Contribution scope fit and linked maintainer decision: correctness fix that implements the documented mapping checks; not applicable. - CLI and MCP/tool-catalog contract: schemas unchanged. Inputs with conflicting table metadata now fail with `unsupported_target` and a specific reason instead of returning complete coverage. - Provider, bridge, target-format, or platform compatibility: ELF32 and ELF64 section headers. - Evidence, artifact, provenance, or reconstruction contract: no completeness claim from ambiguous metadata. - Target selection, authority, upstream behavior, and cleanup details: unchanged. - Generated metadata, package, or installation impact: none; the docs already state this contract. Expected effects: - [x] Read existing files or captured data. ## Evidence and regression coverage - Tests added in `src/flutter/DartElf.test.ts`, as a new `allocated ELF symbol tables` block: - allocated tables with a consistent mapping still resolve - a conflicting `PT_LOAD` over `.dynsym` and over `.dynstr` each refuse with `Dynamic symbol table` / `Dynamic symbol string table has conflicting PT_LOAD mappings` - an `sh_addr` whose mapping disagrees with `sh_offset` refuses with `section offset disagrees with its PT_LOAD mapping` - Base reproduction: against the unfixed `DartElf.ts`, the three refusal cases fail (`3 failed | 24 passed`). - The issue's reproduction (built CLI, synthetic APKs), after: ``` control coverage complete, 4 sections, 2 hash sources symbols unsupported_target: No recognizable Dart snapshot symbols were found: Dynamic symbol table has conflicting PT_LOAD mappings strings unsupported_target: No recognizable Dart snapshot symbols were found: Dynamic symbol string table has conflicting PT_LOAD mappings snapshot coverage partial, 3 sections, 1 hash source (unchanged) ``` Before, `symbols` and `strings` reported `coverage: complete` with 4 sections. - Remaining proof gaps: no Flutter `libapp.so` was available locally. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- src/flutter/DartElf.test.ts tests/boundary/filesystem/flutterBuildProvider.test.ts tests/boundary/cli/flutterCli.test.ts tests/acceptance/flutterAnalysis.test.ts tests/boundary/mcp/dartAotSummaryMcp.test.ts`: 128 passed before the new tests; `src/flutter/DartElf.test.ts` now passes 27 - `npm run check:fast`: passed - Real ELF data. No Flutter `libapp.so` was available locally, so I used two real ARM ELF32 shared libraries from a production Android APK (`libfftw3f.so`, 677 KB; `libanalysis.so`, 14 KB). - Both have allocated `.dynsym`/`.dynstr` (`flags 0x2`, address equal to offset), so the new check runs on them. - The compiled `readElfSymbols` resolved every requested exported symbol listed by `nm -D`, with no failures, in 0.8–1.5 ms. Allocated tables in real libraries pass the new check. ## Compatibility, safety, and release - Breaking changes or migration steps: none for well-formed ELF. Conflicting allocated table metadata is now refused instead of trusted. - Real Hopper/Ghidra, browser, or OS coverage: not applicable. - Package or release metadata impact: none. - Security, privacy, process, or containment review: none; parsing only. ## Author readiness Human owner:  - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:10:42 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5954

No description provided.

Rows
Columns