Preserve payload bytes and checksums in Android sparse images
A merged Ghidra contribution correcting FILL byte order and skipped-block output and CRC accounting.
The problem
Ghidra’s Android sparse-image decompressor reconstructed raw payloads from chunk records. Its FILL path reversed the stored four-byte pattern. Its DONT_CARE path wrote zero-filled output without including those bytes in CRC accounting, and a skipped region exactly equal to the 1 MiB buffer produced no output.
A boundary example
For a skipped region of exactly 1,048,576 bytes, the old greater-than-buffer branch was not entered and the remainder was zero. The resulting write therefore had zero length. The corrected loop emits the full region in bounded writes and updates the CRC for each emitted byte. This example follows from source inspection; it is not a fresh execution result.
The accepted change
The merged source creates a zero buffer bounded by the smaller of the region length and output-buffer size, then writes until the region is exhausted. Each iteration checks cancellation and updates both the checksum and output. The FILL path reconstructs the byte pattern in the order used by the little-endian reader.
Validation and assistance
GitHub records PR #9805 as authored by rudycelekli and merged on October 16, 2026. The PR explicitly discloses implementation generated with OpenAI Codex. It also states that AI-generated unit-test changes were removed from the submitted diff. Its linked validation record used revision 5d2c6a2ba538783d1de0854907070f9f030472ee before that source-only cleanup; it is historical evidence, not validation of the final merge. This case study rechecked authorship, merge state, diff and immutable source on November 4 without rerunning the upstream build or tests.
What this establishes
The public record establishes acceptance of a narrowly scoped parser correction. It does not establish a security vulnerability, a shipped release or package, downstream installations, customer outcomes, or a worldwide contributor ranking. The upstream project is the work of its maintainers and community.
Engineering lesson
For binary transformations, byte order, output length and checksum accounting are one contract. Skipped regions still contribute bytes to the reconstructed image, and exact buffer boundaries deserve explicit attention.
Inspect the evidence
Merged PR and original disclosure · Immutable merge commit · Source at the merge