@bman654/clodex 2.8.4 → 2.8.5

package/dist/cli.js

@@ -382,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.8.4",
+  version: "2.8.5",
   publishConfig: {
     access: "public"
   },
@@ -3820,7 +3820,7 @@ function applyClodexPatches(source, config) {
         const bound = braceScanFailed ? 0 : closingBrace - at - (match.length - 1);
         const missingLiteral = requiredBodyLiterals.find((literal) => !body.includes(literal));
         const scrubbedSeen = scrubbedEnvNames.filter((name) => body.includes(name));
-        const why = missingLiteral !== void 0 ? "body does not contain " + missingLiteral : scrubbedSeen.length < MIN_SCRUBBED_ENV_NAMES ? "body scrubs only " + scrubbedSeen.length + " of the " + scrubbedEnvNames.length + " known child-env names (expected at least " + MIN_SCRUBBED_ENV_NAMES + ")" : /\bfunction\s*[\w$]*\(/.test(body) ? "body declares a nested function" : braceScanFailed ? "the brace walk never reached the function's closing brace" : bound !== 0 ? "match ends " + bound + " characters from the function it started in" : void 0;
+        const why = missingLiteral !== void 0 ? "body does not contain " + missingLiteral : scrubbedSeen.length < MIN_SCRUBBED_ENV_NAMES ? "body spells only " + scrubbedSeen.length + " of the " + scrubbedEnvNames.length + " known child-env names (expected at least " + MIN_SCRUBBED_ENV_NAMES + ")" : /\bfunction\s*[\w$]*\(/.test(body) ? "body declares a nested function" : braceScanFailed ? "the brace walk never reached the function's closing brace" : bound !== 0 ? "match ends " + Math.abs(bound) + " characters " + (bound > 0 ? "before" : "after") + " the end of the function it started in" : void 0;
         if (why !== void 0) {
           log12("FAIL", patchName, "target validation failed: " + why);
           fail("clodex patch: child network environment target validation failed: " + why);
@@ -7066,7 +7066,7 @@ function resignMachOBinary(path) {
 }
 
 // src/bun-compiled-pointer.ts
-import { closeSync as closeSync3, openSync as openSync3, readSync as readSync2, writeSync as writeSync3 } from "fs";
+import { closeSync as closeSync3, fstatSync, openSync as openSync3, readSync as readSync2, writeSync as writeSync3 } from "fs";
 var TWEAKCC_SCAN_STRIDE = 16384n;
 var SCAN_CHUNK = 1 << 20;
 var ELF_MAGIC = 1179403647;
@@ -7098,6 +7098,9 @@ function readElfLayout(fd) {
   const shstrndx = ident.readUInt16LE(62);
   if (shnum === 0 || phnum === 65535) return null;
   if (shstrndx >= shnum || shentsize < 64 || phentsize < 56) return null;
+  const fileSize = fstatSync(fd).size;
+  const fits = (offset, length) => Number.isSafeInteger(offset) && offset >= 0 && length >= 0 && offset + length <= fileSize;
+  if (!fits(Number(shoff), shnum * shentsize)) return null;
   const shTable = readAt2(fd, shnum * shentsize, Number(shoff));
   if (shTable.length !== shnum * shentsize) return null;
   const raw = [];
@@ -7111,6 +7114,7 @@ function readElfLayout(fd) {
     });
   }
   const strtab = raw[shstrndx];
+  if (!fits(Number(strtab.offset), Number(strtab.size))) return null;
   const names = readAt2(fd, Number(strtab.size), Number(strtab.offset));
   const sections = raw.map((section) => {
     const start = section.nameOffset;
@@ -7123,6 +7127,7 @@ function readElfLayout(fd) {
       size: section.size
     };
   });
+  if (!fits(Number(phoff), phnum * phentsize)) return null;
   const phTable = readAt2(fd, phnum * phentsize, Number(phoff));
   if (phTable.length !== phnum * phentsize) return null;
   const segments = [];
@@ -7192,7 +7197,6 @@ function shimBunCompiledPointer(path) {
     if (!segment) return null;
     const needle = Buffer.alloc(8);
     needle.writeBigUInt64LE(bun.addr);
-    if (tweakccWouldFind(fd, segment, needle) !== null) return null;
     const segmentStart = Number(segment.offset);
     const segmentEnd = Number(segment.offset + segment.filesz);
     const bunStart = Number(bun.offset);
@@ -7205,6 +7209,15 @@ function shimBunCompiledPointer(path) {
     }
     const pointerOffset = candidates[0];
     const pointerVaddr = segment.vaddr + BigInt(pointerOffset) - segment.offset;
+    const wouldFind = tweakccWouldFind(fd, segment, needle);
+    if (wouldFind !== null) {
+      if (wouldFind !== pointerVaddr) {
+        throw new Error(
+          `tweakcc's ELF repack would rewrite 0x${wouldFind.toString(16)}, which is not Bun's blob pointer at 0x${pointerVaddr.toString(16)}. Refusing to repack a binary whose Bun global would be left stale.`
+        );
+      }
+      return null;
+    }
     const first = alignUp(segment.vaddr, TWEAKCC_SCAN_STRIDE);
     const last = segment.vaddr + segment.filesz - 8n;
     let standInVaddr = null;
@@ -7241,7 +7254,11 @@ function restoreBunCompiledPointer(path, shim) {
         "the repack left Bun's blob pointer outside the loaded image, or in more than one segment of it"
       );
     }
-    const written = readAt2(fd, 8, standInOffset).readBigUInt64LE(0);
+    const standIn = readAt2(fd, 8, standInOffset);
+    if (standIn.length !== 8) {
+      throw new Error("the repacked binary ends before the stand-in for Bun's blob pointer");
+    }
+    const written = standIn.readBigUInt64LE(0);
     if (written === shim.bunVaddr) {
       throw new Error("the repack did not rewrite Bun's blob pointer \u2014 the stand-in was not used");
     }
@@ -13516,7 +13533,7 @@ import { randomUUID as randomUUID4 } from "crypto";
 import {
   closeSync as closeSync7,
   existsSync as existsSync6,
-  fstatSync,
+  fstatSync as fstatSync2,
   fsyncSync as fsyncSync2,
   lstatSync,
   mkdirSync as mkdirSync6,
@@ -13613,7 +13630,7 @@ function readJournalUnlocked(path) {
       throw new Error("Credential cleanup journal must be a regular file.");
     }
     fd = openSync7(path, "r");
-    const opened = fstatSync(fd);
+    const opened = fstatSync2(fd);
     if (before.dev !== opened.dev || before.ino !== opened.ino) {
       throw new Error("Credential cleanup journal changed while opening.");
     }