Bound Objective-C fixed-field metadata reads

[lynnswap]

Purpose

Prevent malformed fixed-size Objective-C metadata fields from terminating raw helpers with FileIO.offsetOutOfBounds, while preserving readable sibling metadata and publishing bounded typed degradation diagnostics.

Closes #79.

Changes

• Pin the reviewed dependency cohort:
  • MachOObjCSection 0d17e3d77556991dc128aa92547ea1b1ea8f9e2e
  • MachOSwiftSection a7e5982ed7de5dab5dec76036682ea55825b77a8
• Consume the new class-RO and ivar-offset field diagnostics at all six file/image protocol, category, and class read boundaries.
• Prioritize field, protocol, then member diagnostics across the whole target while retaining at most 3 × 256 mapped identities.
• Keep retained diagnostics deduplicated, count cap-excluded observations with saturating arithmetic, and preserve stable offsets and failure reasons when metadata names are long.
• Add rendering, channel-priority, cap, deduplication, omission, canonical ordering, JSON round-trip, and exact dependency-pin tests.
• Keep variable-length table and remaining loaded-image hardening scoped to Unchecked Objective-C table and loaded-image reads can still trap on malformed metadata #83.

Testing

• swift test
• scripts/test-release-scripts.sh
• Xcode 27 cross-compiles:
  • iOS Simulator PrivateHeaderKitCore and PrivateHeaderKitCoreTests
  • watchOS Simulator PrivateHeaderKitCore, PrivateHeaderKitCoreTests, and privateheaderkit-sim-helper
• MachOObjCSection focused fixed-reader, field-diagnostic, protocol, and relative-member suites
• MachOSwiftSection repository CI filter with the pinned Objective-C revision
• codex-review against each dependency base and origin/main: clean

Runtime smoke on iOS 27.0 beta build 24A5390f:

• KoaMapper, SAML, NTKEsterbrookFaceBundleCompanion, and TextInput_zh all completed.
• Artifact counts were 46, 48, 35, and 22 respectively.
• offsetOutOfBounds, signal 5, and SIGTRAP occurrences: 0.
• 53 fixed-field degradations were persisted as bounded typed warnings (24 class-RO, 29 ivar-offset).
• Readable siblings remained present, including KMRadioStationBridge, SAMLNameId, XMLWrapperAttribute, TIZhuyinPunctuationManager, and AtlasImageCache.cachedIndexes.
• The run-owned Simulator was deleted and the temporary runtime match override was restored.

Screenshots

Not applicable.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.