QL-Win/QuickLook · error · PEImageParseException

COFF header incomplete.

Error message

COFF header incomplete.

What it means

The COFF (Common Object File Format) header is a fixed 20-byte structure that immediately follows the 4-byte PE signature. The parser checks that at least 20 bytes remain in the stream after reading the signature; if fewer remain the file is truncated and the COFF header cannot be fully populated. The exception Offset is the current read position (start of the COFF header).

Source

Thrown at QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/PEImage.cs:98

            Reserved7 = reader.ReadUInt16(),
            Reserved8 = reader.ReadUInt16(),
            Reserved9 = reader.ReadUInt16(),
            Reserved10 = reader.ReadUInt16(),
            Reserved11 = reader.ReadUInt16(),
            Reserved12 = reader.ReadUInt16(),
            Reserved13 = reader.ReadUInt16(),
            Reserved14 = reader.ReadUInt16(),
            PEHeaderOffset = reader.ReadUInt32()
        };

        // DOS Stub
        if (reader.BaseStream.Length < DosHeader.PEHeaderOffset) throw new PEImageParseException((int)reader.BaseStream.Position, "DOS stub incomplete.");

        DosStub = reader.ReadBytes((int)(DosHeader.PEHeaderOffset - reader.BaseStream.Position));

        // COFF Header
        if (reader.ReadUInt32() != 0x4550) throw new PEImageParseException((int)reader.BaseStream.Position - 4, "COFF header not found.");
        if (reader.BaseStream.Length - reader.BaseStream.Position < 20) throw new PEImageParseException((int)reader.BaseStream.Position, "COFF header incomplete.");

        CoffHeader = new()
        {
            Machine = (ImageMachineType)reader.ReadUInt16(),
            NumberOfSections = reader.ReadUInt16(),
            TimeDateStamp = reader.ReadUInt32(),
            PointerToSymbolTable = reader.ReadUInt32(),
            NumberOfSymbols = reader.ReadUInt32(),
            SizeOfOptionalHeader = reader.ReadUInt16(),
            Characteristics = (ImageCharacteristics)reader.ReadUInt16()
        };

        // Optional Header
        if (reader.BaseStream.Length - reader.BaseStream.Position < 2) throw new PEImageParseException((int)reader.BaseStream.Position, "Optional header not found.");
        ushort magic = reader.ReadUInt16();

        if (magic == 0x10b)
        {

View on GitHub (pinned to cb5d9c429c)

Solutions

1. Re-download or re-copy the file and verify its byte size matches the original source
2. If processing files from an unreliable source, wrap PEImage.FromFile in a try-catch for PEImageParseException and report the file as corrupt
3. Pre-check that the file is at least PEHeaderOffset + 4 + 20 bytes long before attempting a full parse

// Check minimum file size: DOS header (64) + stub + PE sig (4) + COFF header (20)
static bool IsLargeEnoughForCoffHeader(string path)
{
    var fi = new FileInfo(path);
    if (fi.Length < 0x40) return false;
    byte[] b = File.ReadAllBytes(path);
    int peOff = BitConverter.ToInt32(b, 0x3C);
    return fi.Length >= peOff + 4L + 20L;
}

try
{
    var image = PEImage.FromFile(path);
}
catch (PEImageParseException ex) when (ex.Message.Contains("COFF header"))
{
    // File is truncated at the COFF header stage
    logger.Warn($"Truncated PE file: {ex.Message} at offset {ex.Offset}");
}

When it happens

Trigger: Calling PEImage.FromFile or PEImage.FromBinary on a file whose bytes end within 20 bytes after the valid PE signature. The PE signature read succeeded but the stream has fewer than 20 bytes left for Machine, NumberOfSections, TimeDateStamp, PointerToSymbolTable, NumberOfSymbols, SizeOfOptionalHeader, and Characteristics.

Common situations: A PE binary truncated during download or copy so that it ends right after "PE\0\0"; an artificially small or crafted test file; a file damaged at a network or storage boundary that cut it off mid-COFF-header.

Related errors

• Optional header not found.
• Optional header incomplete.
• Data directories incomplete.
• Section headers incomplete.
• COFF header not found.

AI-assisted analysis of QL-Win/QuickLook@cb5d9c429c (2026-08-13). Data as JSON: /api/errors/b9395d643b14d1e6. Report an issue: GitHub.