wavefnd / wavefnd/Wave

Reject truncated or non-relocatable ELF outputs in object contract checks

Open
#562 0 comments 0 reactions 0 assignees View on GitHub
bug good first issue
Dominant language
Rust
Stars
53
Forks
16
Avg merge
4h 22m
Merged PRs (30d)
46

Description

`read_elf_contract` checks at least 52 bytes, the ELF magic/class/encoding, and enough bytes for e_flags. For ELF64, that still allows a 52-byte file even though the ELF64 header is 64 bytes. It does not inspect e_type, so an executable/shared-object header with matching machine/flags can satisfy an emit=obj contract. These are false-positive artifact checks, separate from the already tracked missing-file path.

Code evidence:

- [tools/test_contracts.py:290](https://github.com/wavefnd/Wave/blob/ea74c2dafc31da876e5561f2d176ba719f5a0458/tools/test_contracts.py#L290)
- [tools/test_contracts.py:308](https://github.com/wavefnd/Wave/blob/ea74c2dafc31da876e5561f2d176ba719f5a0458/tools/test_contracts.py#L308)
- [tools/test_contracts.py:334](https://github.com/wavefnd/Wave/blob/ea74c2dafc31da876e5561f2d176ba719f5a0458/tools/test_contracts.py#L334)

Acceptance:

- [ ] Require the full header for the selected class and validate the expected relocatable object kind (ET_REL) for object contracts.
- [ ] Reject invalid header version/size fields rather than accepting a matching few bytes.
- [ ] Add synthetic-byte fixtures for truncated ELF32/64, ET_EXEC/ET_DYN and valid relocatable headers in supported byte orders.
- [ ] Preserve architecture and RISC-V/LoongArch float ABI checks without requiring a native compiler for the Python tests.

#514 concerns an absent artifact; #463 concerns WebAssembly objects. This issue tightens validation of an existing ELF file.

Audit status: static source inspection against canonical master `ea74c2dafc31da876e5561f2d176ba719f5a0458` on 2026-09-10. No compiler build, test execution, implementation change or local reproduction was performed for this report. The examples describe the source-derived behavior to verify when implementing the fix.

Contributor guide

Open the contributing guide

Research direction

Start in tools/test_contracts.py at read_elf_contract and the referenced checks around lines 290, 308, and 334. Run the Python contract tests and inspect their existing synthetic ELF data. Done means truncated or invalid-version headers, ET_EXEC, and ET_DYN are rejected, while valid ET_REL fixtures in supported byte orders retain architecture and RISC-V/LoongArch ABI validation without a native compiler.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, rust
Domain
compilers, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.