[GH-ISSUE #1990] otool parser accepts required load-command fields with no value (truncated output becomes null) #661

New issue

Closed

opened 2026-10-15 18:27:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:27:04 +00:00

Owner

Originally created by @kaoru0822-kitauji on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1990

Observed behavior

parseOtoolLoadCommands (src/native/parsers/otool.ts) accepts truncated otool -l output in which a required load-command field label has no value. It records the field as null instead of rejecting the output as malformed.

#1967 changed requireUniqueField's pattern to ^\s*<key>(?:\s|$) so that a valueless options row in dylib-use commands counts as present. That pattern applies to every required field. parseField still drops a bare label, so the presence check passes while the value is never parsed.

Measured on main 1f17ac822, by cutting one value from the real tests/fixtures/native-macos/otool-load.txt capture:

Required line truncated to its label	Result
`vmaddr`	accepted; `__TEXT` `vm_address: null`
`vmsize`	accepted; `__TEXT` `vm_size: null`
`uuid`	accepted; `uuid: null`, which reads as "no LC_UUID"
`entryoff`	accepted; entry offset dropped

Before #1967 these were rejected as otool field <key> is missing or repeated. Codex flagged this on #1967 and again on #1972 (P2, "Restrict bare-field matching to empty options"); it is still present on main.

Expected behavior

A required scalar field must appear exactly once and carry a value. Only the dylib-use options row may legitimately be empty. Field-line interpretation should have a single owner (parseField) instead of a second regex.

Originally created by @kaoru0822-kitauji on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1990 ### Observed behavior `parseOtoolLoadCommands` (`src/native/parsers/otool.ts`) accepts truncated `otool -l` output in which a required load-command field label has no value. It records the field as `null` instead of rejecting the output as malformed. #1967 changed `requireUniqueField`'s pattern to `^\s*<key>(?:\s|$)` so that a valueless `options` row in dylib-use commands counts as present. That pattern applies to every required field. `parseField` still drops a bare label, so the presence check passes while the value is never parsed. Measured on main `1f17ac822`, by cutting one value from the real `tests/fixtures/native-macos/otool-load.txt` capture: | Required line truncated to its label | Result | |---|---| | `vmaddr` | accepted; `__TEXT` `vm_address: null` | | `vmsize` | accepted; `__TEXT` `vm_size: null` | | `uuid` | accepted; `uuid: null`, which reads as "no LC_UUID" | | `entryoff` | accepted; entry offset dropped | Before #1967 these were rejected as `otool field <key> is missing or repeated`. Codex flagged this on #1967 and again on #1972 (P2, "Restrict bare-field matching to empty options"); it is still present on main. ### Expected behavior A required scalar field must appear exactly once and carry a value. Only the dylib-use `options` row may legitimately be empty. Field-line interpretation should have a single owner (`parseField`) instead of a second regex.

bsakaguchi

2026-10-15 18:27:04 +00:00