What causes "brew-cask: binary target contains NUL" in jdx/mise?

Re-fetch/refresh the cask definition so the corrupted stanza is replaced with valid text

brew-cask: binary target contains NUL

Error message

brew-cask: binary target contains NUL

What it means

`binary_target_path` rejects a cask `binary` target string containing a NUL byte. NUL is not a valid character in Unix paths and would otherwise truncate the path or indicate a corrupt/hostile cask definition, so it fails fast with this error.

Source

Thrown at src/system/packages/brew/cask/paths.rs:270

    }
    Ok(roots)
}

pub(super) fn is_appdir_binary_target(target_name: &str) -> bool {
    target_name.starts_with("$APPDIR/")
}

pub(super) fn allowed_binary_target_roots_display(roots: &[PathBuf]) -> String {
    roots
        .iter()
        .map(|root| root.display().to_string())
        .collect::<Vec<_>>()
        .join(" or ")
}

pub(super) fn binary_target_path(target_name: &str, appdir: &Path) -> Result<PathBuf> {
    if target_name.contains('\0') {
        bail!("brew-cask: binary target contains NUL");
    }
    if let Some(relative) = target_name.strip_prefix("$APPDIR/") {
        let relative = Path::new(relative);
        reject_appdir_escape(relative, "binary $APPDIR target", target_name)?;
        if !allowed_appdir_roots()?.iter().any(|root| root == appdir) {
            bail!("brew-cask: invalid appdir '{}'", appdir.display());
        }
        return Ok(appdir.join(relative));
    }
    if target_name.contains("$APPDIR") {
        bail!("brew-cask: $APPDIR must prefix a binary target");
    }
    let prefix = prefix::prefix();
    let prefix_str = prefix.to_string_lossy();
    let target_name = target_name.replace("$HOMEBREW_PREFIX", prefix_str.as_ref());
    let path = PathBuf::from(&target_name);
    let target = if path.is_absolute() {
        path

View on GitHub (pinned to afd2eddd3a)

Solutions

Re-fetch/refresh the cask definition so the corrupted stanza is replaced with valid text
Inspect the cask's `binary` value for stray control characters and remove them
Fix custom generation code that embeds NUL (e.g. passing a C buffer without trimming the terminator)
Sanitize/validate target strings before passing them into the install path

Example fix

// before (Rust, constructing targets)
let target = cstring.to_string_lossy(); // keeps trailing '\0'
// after
let target = cstring.to_string_lossy().trim_end_matches('\0').to_string();

Defensive patterns

Strategy: validation

Validate before calling

fn binary_target_ok(t: &str) -> bool {
    !t.contains('\0')
}

Try / catch

match result {
    Err(e) if e.to_string().contains("binary target contains NUL") => {
        eprintln!("cask binary target is corrupt; re-fetch the cask definition");
    }
    r => r?,
}

Prevention

Sanitize cask source decoding so control bytes never enter target strings
Trim C-string terminators when building targets programmatically
Re-download casks that arrive with binary junk
Validate stanza strings with a simple control-character check before install

When it happens

Trigger: Calling `target_path` or `binary_targets_must_stay_under_an_allowed_root` with a cask whose `binary` stanza value embeds `\0` — typically from corrupted cask data, bad decoding of the cask source, or programmatically constructed target strings.

Common situations: Cask file fetched/downloaded incorrectly and containing binary junk; custom tooling that builds target strings with a NUL terminator from C-style buffers; malicious cask attempting path manipulation.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/f98ffef1c70801a0. Report an issue: GitHub.