morluto c209dcb209 fix(artifacts): classify ZIP offsets beyond EOF as malformed ...

Reject negative bounded reads before allocation while retaining short-read and exact-EOF behavior. Exercise the corrupted central-directory offset through the public CLI.

Refs #4006, #3953

Co-authored-by: jackie_cqz <88996311+jackie-cqz@users.noreply.github.com>

2026-10-16 03:49:44 +08:00

..

adb

fix(adb)!: keep the exact Android long version code (#3485)

2026-10-14 17:01:25 -07:00

android

fix(providers)!: preserve readiness, coverage, and diagnostic ownership

2026-10-14 08:28:14 +08:00

apktool

fix(apktool): own the version probe's process group and keep its timeout typed (#3808)

2026-10-14 21:37:52 -07:00

application

fix(javascript): preserve analysis applicability after interruption (#4207)

2026-10-16 03:46:00 +08:00

artifacts

fix(artifacts): classify ZIP offsets beyond EOF as malformed

2026-10-16 03:49:44 +08:00

browser

fix(browser): disclose connected platform-emulation teardown limits

2026-10-16 02:47:04 +08:00

captures

fix(browser): bound capture work and preserve observation gaps

2026-10-14 08:31:29 +08:00

cli

fix(cli): validate integer tokens before coercion

2026-10-16 03:13:06 +08:00

composition

feat(kuna): serve procedures, pseudocode and assembly from Kuna exports (#3854)

2026-10-15 00:53:26 -07:00

config

fix(jeb): isolate invalid timeout from shared startup (#3964)

2026-10-16 01:03:39 +08:00

contracts

fix(mcp): relax Boolean literals without narrowing valid inputs

2026-10-16 03:13:14 +08:00

cutter

fix(cutter): resolve bridge paths from the selected caller home

2026-10-15 04:01:36 +08:00

domain

fix(javascript): bind native handoffs to canonical byte identity

2026-10-15 17:08:49 +00:00

dotnet

fix(managed): charge admitted member facts once in the final projection (#3487)

2026-10-14 17:19:33 -07:00

electron

fix(electron): preserve selected fuse inspection paths (#3104)

2026-10-14 12:49:17 +08:00

evaluation

fix(evaluation): require explicit REA server attribution

2026-10-14 09:47:57 +08:00

evm

fix(evm): preserve transferred cleanup ownership and bounded output

2026-10-14 14:47:26 +08:00

filesystem

fix(paths): select caller paths through symlinks and .. as the filesystem does (#4067)

2026-10-15 05:19:43 -07:00

firmware

fix(paths): select caller paths through symlinks and .. as the filesystem does (#4067)

2026-10-15 05:19:43 -07:00

flutter

fix(flutter): check section-backed symbol tables against PT_LOAD (#3859)

2026-10-14 23:02:49 -07:00

frida

fix(frida): preserve attach targets and reconcile early detachment

2026-10-14 16:10:46 +08:00

gdb

fix(reverse): reconcile cleanup ownership and mutation diagnostics (#2799)

2026-10-14 04:47:34 +08:00

ghidra

ci(ghidra): compile the packaged bridge source cohort (#3142)

2026-10-15 18:11:19 +00:00

go

fix(native): retain partial format facts and explicit coverage

2026-10-14 08:29:16 +08:00

hopper

feat(kuna): serve procedures, pseudocode and assembly from Kuna exports (#3854)

2026-10-15 00:53:26 -07:00

ida

fix(ida): share string-page failure interpretation

2026-10-16 03:49:44 +08:00

inspector

fix(inspector): retain usable targets and cancel owned capture waits

2026-10-14 09:47:57 +08:00

javascript

fix(javascript): reject FIFO recovery inputs without blocking (#3788)

2026-10-14 20:21:34 -07:00

jeb

fix(jeb): make upstream request deadlines configurable and preserve cancellation

2026-10-15 05:05:18 +08:00

kuna

fix(kuna): answer a repeated single-function request without re-running Kuna (#4169)

2026-10-15 09:36:05 -07:00

main

fix(mcp): release optional providers when transport startup fails

2026-10-14 16:10:46 +08:00

native

fix(pe): retain empty resources at virtual section endpoints

2026-10-16 02:47:04 +08:00

objdump

fix(paths): select caller paths through symlinks and .. as the filesystem does (#4067)

2026-10-15 05:19:43 -07:00

pcap

fix(pcap): retain parsed observations when process cleanup fails

2026-10-14 13:40:53 +08:00

process

feat(kuna): serve procedures, pseudocode and assembly from Kuna exports (#3854)

2026-10-15 00:53:26 -07:00

reference

fix(reference): preserve missing symlink target facts

2026-10-14 08:43:59 +08:00

rizin

fix(paths): select caller paths through symlinks and .. as the filesystem does (#4067)

2026-10-15 05:19:43 -07:00

rust

fix(rust): retain compatible cargo-auditable revisions

2026-10-14 14:47:26 +08:00

server

fix(server): retain session admission through investigation publication

2026-10-16 03:13:20 +08:00

signals

fix(analysis): preserve extraction gaps and database failure reasons

2026-10-14 08:32:15 +08:00

sqlite

fix(sqlite): preserve snapshot admission failure semantics

2026-10-16 03:49:44 +08:00

wasm

fix(paths): select caller paths through symlinks and .. as the filesystem does (#4067)

2026-10-15 05:19:43 -07:00

windows

fix(windows): retry owned runtime cleanup on sharing conflicts

2026-10-16 03:13:10 +08:00

catalogIdentity.ts

perf(catalog): record default catalog digests at build time (#4041)

2026-10-15 02:19:38 -07:00

cli.ts

fix(reverse): reconcile cleanup ownership and mutation diagnostics (#2799)

2026-10-14 04:47:34 +08:00

cliBrowserContext.ts

…

cliBrowserScenarioCommands.ts

fix(cli): await browser scenario cleanup on interrupts

2026-10-11 17:33:57 +08:00

cliCommandNames.ts

feat(electron): inspect packaged Electron fuse state without execution (#2399)

2026-10-14 09:16:33 +08:00

cliEvidenceCommands.ts

perf(mcp): keep Playwright and type-only imports off MCP startup (#1691)

2026-10-10 21:04:05 -07:00

cliHostInputs.test.ts

…

cliJavaScriptRuntimeCommands.ts

fix(browser): bound capture work and preserve observation gaps

2026-10-14 08:31:29 +08:00

cliJsonInput.ts

fix(cli): keep file URLs out of operator-relative path resolution (#2882)

2026-10-14 01:05:14 +08:00

cliJsonPaths.test.ts

fix(cli): keep file URLs out of operator-relative path resolution (#2882)

2026-10-14 01:05:14 +08:00

cliLogging.test.ts

feat(update): update Bun global installations (#1735)

2026-10-11 17:56:05 +08:00

cliLogging.ts

fix(cli): preserve failure semantics across full-output formats

2026-10-13 03:33:27 +08:00

cliObservationOptions.ts

fix(javascript): trace wrapped Electron IPC paths in large bundles (#1874)

2026-10-12 09:28:59 +08:00

cliOutput.ts

fix(cli): accept --flag=value for global output flags (#3811)

2026-10-14 20:22:02 -07:00

config.test.ts

fix(jeb): make upstream request deadlines configurable and preserve cancellation

2026-10-15 05:05:18 +08:00

doctorRuntime.test.ts

feat(kuna): add Kuna readiness, doctor and owned project cache (#3832)

2026-10-15 05:56:56 +00:00

doctorRuntime.ts

feat(kuna): add Kuna readiness, doctor and owned project cache (#3832)

2026-10-15 05:56:56 +00:00

generatedPackageMetadata.ts

chore(main): release rea-agents 6.5.0 (#1693)

2026-10-14 20:31:45 +08:00

homeDirectory.test.ts

fix(setup): ignore empty home directory selections

2026-10-13 04:11:55 +08:00

identity.ts

…

logger.ts

fix(cli): report an invalid REA_LOG_LEVEL as configuration (#2140)

2026-10-12 06:07:37 -07:00

main.ts

fix(identity)!: preserve invocation uncertainty and advertised catalogs

2026-10-14 16:10:46 +08:00

mcpDoctor.ts

fix(mcp): bind catalog identity to output schema profiles

2026-10-15 01:41:31 +08:00

mcpStartupPolicy.ts

fix(setup): include registered IDA budgets in client deadlines

2026-10-15 07:36:34 +08:00

recordedCatalogDigests.ts

perf(catalog): record default catalog digests at build time (#4041)

2026-10-15 02:19:38 -07:00

serverIdentity.ts

fix(identity)!: preserve invocation uncertainty and advertised catalogs

2026-10-14 16:10:46 +08:00

setupEnvironment.test.ts

refactor(setup): distinguish provider configuration from registration settings

2026-10-15 05:23:04 +08:00