morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2446] [Bug] pwntools provider rejects artifacts over a hardcoded 32 MiB inputBytes limit #818

New issue

Closed

opened 2026-10-15 18:28:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:28:44 +00:00

Owner

Originally created by @amateurdcb on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2446

Area

Native analysis or decompilation

Observed behavior

The pwntools-elf provider rejects any artifact larger than 32 MiB with an invalid_request / out_of_range error before any analysis runs. The bound is hardcoded in src/native/pwntools/PwntoolsRelease.ts as PWNTOOLS_LIMITS.inputBytes = 32 * 1024 * 1024 and cannot be raised through configuration, environment variables, CLI flags, or MCP parameters.

This affects both inspect_recorded_crash (Linux ELF core dumps) and inspect_binary_layout (ELF layout analysis). Real-world core dumps are routinely 100 MB–several GB, so the current bound excludes most genuine crash artifacts.

Reproduction

Obtain a Linux ELF core dump larger than 32 MiB (e.g. a 165 MiB core-8902-zk_proxy-1790585482).
Configure REA_PWNTOOLS_PYTHON to a Python with pwntools 4.15.0, pyelftools 0.33, unicorn 2.1.2.

Run:

REA_PWNTOOLS_PYTHON=<python> rea inspect-recorded-crash <core> --format json

Observe the rejection.

Expected behavior

A configurable input size bound (e.g. REA_PWNTOOLS_MAX_INPUT_BYTES, defaulting to the current 32 MiB) so operators can analyze large core dumps without weakening the default protection.

If a fixed bound is preferred instead, it should be raised together with outputBytes and timeoutMs, since raising inputBytes alone only moves the failure to the output or timeout stage:

inputBytes: 32 MiB → 256 MiB
outputBytes: 64 MiB → 128 MiB (must be changed in both src/native/pwntools/PwntoolsRelease.ts and bridge/pwntools/decoder_runtime.py)
timeoutMs: 30_000 → 120_000

Impact and scope

Affected: every core dump and ELF artifact over 32 MiB — i.e. the majority of real crash dumps — cannot be analyzed by the pwntools provider at all.
Not affected: artifacts under 32 MiB work normally.
Evidence integrity: no impact; the request is rejected before any Evidence is produced.
Workaround: temporarily editing inputBytes in the installed dist/ build works but is overwritten on upgrade and is not a supported path.

REA version

6.4.0

Runtime and platform

Node 24.14.1; Linux x64; pwntools 4.15.0, pyelftools 0.33, unicorn 2.1.2

Target and artifact context

ELF core dump, x86_64-little-endian, 172,879,872 bytes (165 MiB)

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

{
  "code": "invalid_request",
  "category": "invalid_request",
  "issues": [
    {
      "path": ["path"],
      "reason": "out_of_range",
      "message": "Selected artifact exceeds 33554432 bytes: /tmp/core-8902-zk_proxy-1790585482"
    }
  ]
}

Source bound: src/native/pwntools/PwntoolsRelease.ts → PWNTOOLS_LIMITS.inputBytes = 32 * 1024 * 1024
Consumed at: src/native/pwntools/PwntoolsDecoder.ts (readStableArtifact(input.path, PWNTOOLS_LIMITS.inputBytes, ...))
Enforced at: src/artifacts/readStableArtifact.ts (Selected artifact exceeds ... bytes)

Originally created by @amateurdcb on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2446 ### Area Native analysis or decompilation ### Observed behavior The `pwntools-elf` provider rejects any artifact larger than 32 MiB with an `invalid_request` / `out_of_range` error before any analysis runs. The bound is hardcoded in `src/native/pwntools/PwntoolsRelease.ts` as `PWNTOOLS_LIMITS.inputBytes = 32 * 1024 * 1024` and cannot be raised through configuration, environment variables, CLI flags, or MCP parameters. This affects both `inspect_recorded_crash` (Linux ELF core dumps) and `inspect_binary_layout` (ELF layout analysis). Real-world core dumps are routinely 100 MB–several GB, so the current bound excludes most genuine crash artifacts. ### Reproduction 1. Obtain a Linux ELF core dump larger than 32 MiB (e.g. a 165 MiB `core-8902-zk_proxy-1790585482`). 2. Configure `REA_PWNTOOLS_PYTHON` to a Python with pwntools 4.15.0, pyelftools 0.33, unicorn 2.1.2. 3. Run: ```bash REA_PWNTOOLS_PYTHON=<python> rea inspect-recorded-crash <core> --format json ``` 4. Observe the rejection. ### Expected behavior A configurable input size bound (e.g. `REA_PWNTOOLS_MAX_INPUT_BYTES`, defaulting to the current 32 MiB) so operators can analyze large core dumps without weakening the default protection. If a fixed bound is preferred instead, it should be raised together with `outputBytes` and `timeoutMs`, since raising `inputBytes` alone only moves the failure to the output or timeout stage: - `inputBytes`: 32 MiB → 256 MiB - `outputBytes`: 64 MiB → 128 MiB (must be changed in both `src/native/pwntools/PwntoolsRelease.ts` and `bridge/pwntools/decoder_runtime.py`) - `timeoutMs`: 30_000 → 120_000 ### Impact and scope - **Affected:** every core dump and ELF artifact over 32 MiB — i.e. the majority of real crash dumps — cannot be analyzed by the pwntools provider at all. - **Not affected:** artifacts under 32 MiB work normally. - **Evidence integrity:** no impact; the request is rejected before any Evidence is produced. - **Workaround:** temporarily editing `inputBytes` in the installed `dist/` build works but is overwritten on upgrade and is not a supported path. ### REA version 6.4.0 ### Runtime and platform Node 24.14.1; Linux x64; pwntools 4.15.0, pyelftools 0.33, unicorn 2.1.2 ### Target and artifact context ELF core dump, x86_64-little-endian, 172,879,872 bytes (165 MiB) ### Interface CLI ### Earliest failure stage Request parsing or validation ### Relevant output or evidence ```json { "code": "invalid_request", "category": "invalid_request", "issues": [ { "path": ["path"], "reason": "out_of_range", "message": "Selected artifact exceeds 33554432 bytes: /tmp/core-8902-zk_proxy-1790585482" } ] } ``` Source bound: `src/native/pwntools/PwntoolsRelease.ts` → `PWNTOOLS_LIMITS.inputBytes = 32 * 1024 * 1024` Consumed at: `src/native/pwntools/PwntoolsDecoder.ts` (`readStableArtifact(input.path, PWNTOOLS_LIMITS.inputBytes, ...)`) Enforced at: `src/artifacts/readStableArtifact.ts` (`Selected artifact exceeds ... bytes`)

bsakaguchi

2026-10-15 18:28:44 +00:00

closed this issue
added the
bug
label

bsakaguchi referenced this issue

2026-10-16 21:16:27 +00:00

[PR #818] [MERGED] fix: address review nits from batch integration follow-ups #2263

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#818

No description provided.

Rows
Columns