QL-Win/QuickLook · error · PEImageParseException

Section '{Header.Name}' incomplete.

Error message

Section '{Header.Name}' incomplete.

What it means

Thrown by ImageSection.SetDataFromRsrc(byte[]) when the section's raw data range falls outside the image. The check is Header.PointerToRawData + Header.SizeOfRawData <= originalImage.Length; if the section header claims bytes the file does not contain, PEImageParseException is raised with the section name. This catches a PE whose section table points past EOF.

Source

Thrown at QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/ImageSection.cs:36

    /// <summary>
    /// Gets a <see cref="byte" />[] representing the contents of the section.
    /// </summary>
    public byte[] Data { get; set; } = null!;

    internal ImageSection(ImageSectionHeader header)
    {
        Header = header;
    }

    public void SetDataFromRsrc(byte[] originalImage)
    {
        if (Header.PointerToRawData + Header.SizeOfRawData <= originalImage.Length)
        {
            Data = originalImage.GetBytes((int)Header.PointerToRawData, (int)Header.SizeOfRawData);
        }
        else
        {
            throw new PEImageParseException(int.MinValue, "Section '" + Header.Name + "' incomplete.");
        }
    }

    public void SetDataFromRsrc(Stream originalImage, uint? length = null)
    {
        if (Header.PointerToRawData + Header.SizeOfRawData <= (length ?? originalImage.Length))
        {
            Data = originalImage.GetBytes((int)Header.PointerToRawData, (int)Header.SizeOfRawData);
        }
        else
        {
            throw new PEImageParseException(int.MinValue, "Section '" + Header.Name + "' incomplete.");
        }
    }
}

/// <summary>
/// Provides support for creation and generation of generic objects.

View on GitHub (pinned to cb5d9c429c)

Solutions

1. Re-obtain the binary (re-download/rebuild) — a section claiming data past EOF means the file is incomplete.
2. Before parsing, sanity-check that file length is at least the maximum section PointerToRawData+SizeOfRawData.
3. If you control the parser, clamp SizeOfRawData to the available bytes and decode only what exists, rather than throwing.
4. Catch PEImageParseException and report 'corrupt or truncated PE' to the user.

Example fix

// before
if (Header.PointerToRawData + Header.SizeOfRawData <= originalImage.Length)
    Data = originalImage.GetBytes((int)Header.PointerToRawData, (int)Header.SizeOfRawData);
else throw new PEImageParseException(int.MinValue, "Section '" + Header.Name + "' incomplete.");

// after — read whatever is actually present
int avail = Math.Max(0, originalImage.Length - (int)Header.PointerToRawData);
Data = originalImage.GetBytes((int)Header.PointerToRawData, Math.Min((int)Header.SizeOfRawData, avail));

long maxEnd = sections.Max(s => (long)s.Header.PointerToRawData + s.Header.SizeOfRawData);
if (maxEnd > originalImage.Length) { /* truncated PE; do not call SetDataFromRsrc for overrunning sections */ }

try { section.SetDataFromRsrc(originalImage); }
catch (PEImageParseException) { /* skip section */ }

When it happens

Trigger: A PE/EXE/DLL section whose PointerToRawData + SizeOfRawData exceeds the byte-array length — typical of a truncated or stripped binary, or a section header with bogus raw-data pointers (e.g. crafted/packed malware).

Common situations: An executable truncated during download/copy; a packer/protector that intentionally sets large SizeOfRawData; a corrupt copy where trailing sections were dropped; loading a file that is not actually a PE but passed earlier checks.

Related errors

• DOS header incomplete.
• The stream has fewer bytes available than requested.
• DOS signature not found.
• DOS header not found.
• The minidump stream directory is outside the file.

AI-assisted analysis of QL-Win/QuickLook@cb5d9c429c (2026-08-13). Data as JSON: /api/errors/3ab0a1817e9c6bd1. Report an issue: GitHub.