[GH-ISSUE #2585] fix(managed): retain complete embedded resources in generated fixtures #903

New issue

Closed

opened 2026-10-15 18:29:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:29:26 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2585

Summary

A managed verification fixture requested with 2045 resource bytes returns a directory that is one byte shorter than its declared size. Managed inspection still recognizes the image but reports the resource directory and embedded resource as invalid. Consumers cannot inspect or extract the complete requested resource.

Steps to reproduce

From the repository root in the environment below, build fixtures on either side of the resource capacity boundary. The command only constructs buffers and reads their headers.

node --input-type=module <<'JS'
import { buildManagedPeFixture } from './scripts/fixtures/managed/pe.mjs';
for (const size of [2044, 2045]) {
  const bytes = buildManagedPeFixture({ resourceData: Buffer.alloc(size, 0x41) });
  const resourceRva = bytes.readUInt32LE(0x218);
  const offset = resourceRva - 0x2000 + 0x200;
  console.log(JSON.stringify({ resourceDataBytes: size, imageBytes: bytes.length,
    declaredResourcesBytes: bytes.readUInt32LE(0x21c),
    remainingFileBytes: bytes.length - offset }));
}
JS

Expected behavior

Both requested resource buffers are stored in full inside a file-backed CLI resources directory. Managed artifact inspection can locate the embedded resource without resource-directory or manifest-resource errors. Preserving the directory must also preserve the fixture's other requested data.

Actual behavior

With 2044 data bytes, the 2048-byte directory fits the remaining 2048 file bytes. With 2045 data bytes, the producer declares 2049 directory bytes in the same space. A focused source-inspector test reproduced invalid-directory at cli.resources and invalid-resource at metadata.ManifestResource:0x28000001 only for the latter case. Both cases were classified as managed. The smaller control establishes resource-directory readability, rather than validity of every other fixture region.

Evidence

Expected source: scripts/fixtures/managed/pe.d.mts:26 accepts a resource Buffer without a size bound; scripts/fixtures/managed/pe.mjs:390 promises a PE/CLI fixture; AGENTS.md:75 requires accounting for representation expansion before allocation.
Failure source: scripts/fixtures/managed/pe.mjs:330 constructs the full directory, :334 allocates a fixed image, :375 writes the full directory size, and :386 copies only the bytes that fit. The command and source-inspector test observed the resulting mismatch.
Evidence provenance: observed
Local verification: reproduced
Reproduction completeness: complete

The embedded resource offset is zero. Its invalid-resource diagnostic follows the failure to map the enclosing directory, rather than proving that zero itself lies outside a valid directory.

Restoration check

Repeat both inputs and resolve the resources directory through its declared RVA. Require its full declared size to be file-backed and require the embedded data to equal the requested buffer. Managed artifact inspection must report neither of the observed resource issues. Check that method bytes and metadata also remain intact if the restored layout changes their positions. Dropping resource bytes or shortening the declared size does not restore this contract.

Runtime or environment

Repository revision 8b181716ac; Node v26.10.0; locked dependencies already installed. The diagnostic check used the focused source test runner.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A supported resource input loses fixture data and produces invalid resource diagnostics while the image otherwise remains classified managed; the verified scope is generated verification fixtures.
Workaround status: unverified
Workaround basis: Smaller buffers fit this directory but discard requested data; no workaround preserving the complete input was verified.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2585 ## Summary A managed verification fixture requested with 2045 resource bytes returns a directory that is one byte shorter than its declared size. Managed inspection still recognizes the image but reports the resource directory and embedded resource as invalid. Consumers cannot inspect or extract the complete requested resource. ## Steps to reproduce From the repository root in the environment below, build fixtures on either side of the resource capacity boundary. The command only constructs buffers and reads their headers. ```bash node --input-type=module <<'JS' import { buildManagedPeFixture } from './scripts/fixtures/managed/pe.mjs'; for (const size of [2044, 2045]) { const bytes = buildManagedPeFixture({ resourceData: Buffer.alloc(size, 0x41) }); const resourceRva = bytes.readUInt32LE(0x218); const offset = resourceRva - 0x2000 + 0x200; console.log(JSON.stringify({ resourceDataBytes: size, imageBytes: bytes.length, declaredResourcesBytes: bytes.readUInt32LE(0x21c), remainingFileBytes: bytes.length - offset })); } JS ``` ## Expected behavior Both requested resource buffers are stored in full inside a file-backed CLI resources directory. Managed artifact inspection can locate the embedded resource without resource-directory or manifest-resource errors. Preserving the directory must also preserve the fixture's other requested data. ## Actual behavior With 2044 data bytes, the 2048-byte directory fits the remaining 2048 file bytes. With 2045 data bytes, the producer declares 2049 directory bytes in the same space. A focused source-inspector test reproduced `invalid-directory` at `cli.resources` and `invalid-resource` at `metadata.ManifestResource:0x28000001` only for the latter case. Both cases were classified as managed. The smaller control establishes resource-directory readability, rather than validity of every other fixture region. ## Evidence - Expected source: `scripts/fixtures/managed/pe.d.mts:26` accepts a resource Buffer without a size bound; `scripts/fixtures/managed/pe.mjs:390` promises a PE/CLI fixture; `AGENTS.md:75` requires accounting for representation expansion before allocation. - Failure source: `scripts/fixtures/managed/pe.mjs:330` constructs the full directory, `:334` allocates a fixed image, `:375` writes the full directory size, and `:386` copies only the bytes that fit. The command and source-inspector test observed the resulting mismatch. - Evidence provenance: observed - Local verification: reproduced - Reproduction completeness: complete The embedded resource offset is zero. Its invalid-resource diagnostic follows the failure to map the enclosing directory, rather than proving that zero itself lies outside a valid directory. ## Restoration check Repeat both inputs and resolve the resources directory through its declared RVA. Require its full declared size to be file-backed and require the embedded data to equal the requested buffer. Managed artifact inspection must report neither of the observed resource issues. Check that method bytes and metadata also remain intact if the restored layout changes their positions. Dropping resource bytes or shortening the declared size does not restore this contract. ## Runtime or environment Repository revision 8b181716aca2cb467be499cba226abfb5ae19141; Node v26.10.0; locked dependencies already installed. The diagnostic check used the focused source test runner. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A supported resource input loses fixture data and produces invalid resource diagnostics while the image otherwise remains classified managed; the verified scope is generated verification fixtures. - Workaround status: unverified - Workaround basis: Smaller buffers fit this directory but discard requested data; no workaround preserving the complete input was verified.

bsakaguchi

2026-10-15 18:29:26 +00:00