morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[PR #4183] [CLOSED] fix(native): reject an oversized SET_ADDEND_SLEB operand instead of running its tail as opcodes #6114

New issue

Closed

opened 2026-10-31 01:11:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:11:58 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4183
Author: @arjunprabhulal
Created: 10/15/2026
Status: ❌ Closed

Base: main ← Head: fix/macho-bind-sleb-oversized

📝 Commits (2)

02ce137 fix(native): reject an oversized SET_ADDEND_SLEB operand instead of running its tail as opcodes
0cbabc7 test(native): cover ten-byte SET_ADDEND_SLEB addends at the signed 64-bit limits

📊 Changes

2 files changed (+59 additions, -1 deletions)

View changed files

📝 src/native/AppleMachoFixups.test.ts (+57 -0)
📝 src/native/AppleMachoFixups.ts (+2 -1)

📄 Description

Summary

An LC_DYLD_INFO bind stream whose BIND_OPCODE_SET_ADDEND_SLEB operand has more than ten continuation bytes is decoded as if the operand ended early. The remaining operand bytes are then interpreted as bind opcodes, so REA can record a bind that dyld never performs and still report the stream as fully decoded with no failures.

Problem and expected behavior

sleb in src/native/AppleMachoFixups.ts loops while ((byte & 0x80) !== 0 && shift <= 63n), so after ten bytes it returns even when the last byte still has its continuation bit set. dyld keeps consuming operand bytes while bit 7 is set. The sibling uleb already throws Oversized bind opcode operand in the same situation.

Smallest trigger: 11 40 5f 78 00 71 08 60 80×10 90 00. dyld reads the 0x90 as part of the addend and binds nothing. On main, REA stops the SLEB after the ten 0x80 bytes, runs 0x90 as DO_BIND, and decode(BASE + 0x4008) returns { kind: "bind", symbol: "_x", ... } with failures: [].

Change and scope

sleb now throws Oversized bind opcode operand before reading a byte past bit 63 and loops only on the continuation bit, matching uleb. A valid SLEB of up to ten bytes decodes as before. The failure is reported through the existing per-stream failure path. Nothing else in the bind state machine changes.

Contract and boundary impact

Semantic owner and earliest changed stage: Mach-O legacy bind decoding (src/native/AppleMachoFixups.ts).
Contribution scope fit and linked maintainer decision: ordinary fix within existing boundaries; not applicable.
CLI and MCP/tool-catalog contract: none.
Provider, bridge, target-format, or platform compatibility: Mach-O LC_DYLD_INFO / LC_DYLD_INFO_ONLY only.
Evidence, artifact, provenance, or reconstruction contract: a malformed stream now reports a failure instead of a fabricated bind.
Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable.
Generated metadata, package, or installation impact: none.
Read existing files or captured data.

Evidence and regression coverage

Tests added or updated: src/native/AppleMachoFixups.test.ts — one test that a valid SET_ADDEND_SLEB (-8) reaches the following bind, and one that the oversized stream above reports Oversized bind opcode operand and leaves the slot unbound.
Base reproduction or other evidence (executed): on main, failures is [] and the slot decodes as {"kind":"bind","symbol":"_x","library":"/usr/lib/libSystem.B.dylib","weak":false,"addend":0n}; with this change failures is ["bind bind opcodes: Oversized bind opcode operand"] and the slot decodes as a rebase.
Remaining proof gaps: none known.
Observed, derived, and inferred claims remain distinguishable.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npx vitest run src/native/ — 16 files, 241 passed (the oversized case fails on main)
npx tsc --noEmit -p . — no errors
npx prettier --check on the changed files — clean
npx oxlint on the changed files — only the existing size/complexity warnings for AppleMachoFixups.ts

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4183 **Author:** [@arjunprabhulal](https://github.com/arjunprabhulal) **Created:** 10/15/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/macho-bind-sleb-oversized` --- ### 📝 Commits (2) - [`02ce137`](https://github.com/morluto/rea/commit/02ce137d01b68c36fd8c95a172eba3988a791b33) fix(native): reject an oversized SET_ADDEND_SLEB operand instead of running its tail as opcodes - [`0cbabc7`](https://github.com/morluto/rea/commit/0cbabc7d944ad6d1531bcd4903200c1f171dd9ce) test(native): cover ten-byte SET_ADDEND_SLEB addends at the signed 64-bit limits ### 📊 Changes **2 files changed** (+59 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/native/AppleMachoFixups.test.ts` (+57 -0) 📝 `src/native/AppleMachoFixups.ts` (+2 -1) </details> ### 📄 Description ## Summary An `LC_DYLD_INFO` bind stream whose `BIND_OPCODE_SET_ADDEND_SLEB` operand has more than ten continuation bytes is decoded as if the operand ended early. The remaining operand bytes are then interpreted as bind opcodes, so REA can record a bind that dyld never performs and still report the stream as fully decoded with no failures. ## Problem and expected behavior `sleb` in `src/native/AppleMachoFixups.ts` loops `while ((byte & 0x80) !== 0 && shift <= 63n)`, so after ten bytes it returns even when the last byte still has its continuation bit set. dyld keeps consuming operand bytes while bit 7 is set. The sibling `uleb` already throws `Oversized bind opcode operand` in the same situation. Smallest trigger: `11 40 5f 78 00 71 08 60 80×10 90 00`. dyld reads the `0x90` as part of the addend and binds nothing. On `main`, REA stops the SLEB after the ten `0x80` bytes, runs `0x90` as `DO_BIND`, and `decode(BASE + 0x4008)` returns `{ kind: "bind", symbol: "_x", ... }` with `failures: []`. ## Change and scope `sleb` now throws `Oversized bind opcode operand` before reading a byte past bit 63 and loops only on the continuation bit, matching `uleb`. A valid SLEB of up to ten bytes decodes as before. The failure is reported through the existing per-stream failure path. Nothing else in the bind state machine changes. ## Contract and boundary impact - Semantic owner and earliest changed stage: Mach-O legacy bind decoding (`src/native/AppleMachoFixups.ts`). - Contribution scope fit and linked maintainer decision: ordinary fix within existing boundaries; not applicable. - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: Mach-O `LC_DYLD_INFO` / `LC_DYLD_INFO_ONLY` only. - Evidence, artifact, provenance, or reconstruction contract: a malformed stream now reports a failure instead of a fabricated bind. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable. - Generated metadata, package, or installation impact: none. - [x] Read existing files or captured data. ## Evidence and regression coverage - Tests added or updated: `src/native/AppleMachoFixups.test.ts` — one test that a valid `SET_ADDEND_SLEB` (-8) reaches the following bind, and one that the oversized stream above reports `Oversized bind opcode operand` and leaves the slot unbound. - Base reproduction or other evidence (executed): on `main`, `failures` is `[]` and the slot decodes as `{"kind":"bind","symbol":"_x","library":"/usr/lib/libSystem.B.dylib","weak":false,"addend":0n}`; with this change `failures` is `["bind bind opcodes: Oversized bind opcode operand"]` and the slot decodes as a rebase. - Remaining proof gaps: none known. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npx vitest run src/native/` — 16 files, 241 passed (the oversized case fails on `main`) - `npx tsc --noEmit -p .` — no errors - `npx prettier --check` on the changed files — clean - `npx oxlint` on the changed files — only the existing size/complexity warnings for `AppleMachoFixups.ts` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:11:58 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:45:52 +00:00

[PR #6150] [CLOSED] fix(diagnostics): attribute input and refusal failures to their source #7165

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6114

No description provided.

Rows
Columns