{"record":{"id":"3ab0a1817e9c6bd1","repo":"QL-Win/QuickLook","slug":"section-header-name-incomplete","errorCode":null,"errorMessage":"Section '{Header.Name}' incomplete.","messagePattern":"Section '(.+?)' incomplete\\.","errorType":"exception","errorClass":"PEImageParseException","httpStatus":null,"severity":"error","filePath":"QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/ImageSection.cs","lineNumber":36,"sourceCode":"    /// <summary>\n    /// Gets a <see cref=\"byte\" />[] representing the contents of the section.\n    /// </summary>\n    public byte[] Data { get; set; } = null!;\n\n    internal ImageSection(ImageSectionHeader header)\n    {\n        Header = header;\n    }\n\n    public void SetDataFromRsrc(byte[] originalImage)\n    {\n        if (Header.PointerToRawData + Header.SizeOfRawData <= originalImage.Length)\n        {\n            Data = originalImage.GetBytes((int)Header.PointerToRawData, (int)Header.SizeOfRawData);\n        }\n        else\n        {\n            throw new PEImageParseException(int.MinValue, \"Section '\" + Header.Name + \"' incomplete.\");\n        }\n    }\n\n    public void SetDataFromRsrc(Stream originalImage, uint? length = null)\n    {\n        if (Header.PointerToRawData + Header.SizeOfRawData <= (length ?? originalImage.Length))\n        {\n            Data = originalImage.GetBytes((int)Header.PointerToRawData, (int)Header.SizeOfRawData);\n        }\n        else\n        {\n            throw new PEImageParseException(int.MinValue, \"Section '\" + Header.Name + \"' incomplete.\");\n        }\n    }\n}\n\n/// <summary>\n/// Provides support for creation and generation of generic objects.","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/QL-Win/QuickLook/blob/cb5d9c429c81d9796fac469da2a68efb5626946d/QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/ImageSection.cs#L18-L54","documentation":"Thrown by ImageSection.SetDataFromRsrc(byte[]) when the section's raw data range falls outside the image. The check is Header.PointerToRawData + Header.SizeOfRawData <= originalImage.Length; if the section header claims bytes the file does not contain, PEImageParseException is raised with the section name. This catches a PE whose section table points past EOF.","triggerScenarios":"A PE/EXE/DLL section whose PointerToRawData + SizeOfRawData exceeds the byte-array length — typical of a truncated or stripped binary, or a section header with bogus raw-data pointers (e.g. crafted/packed malware).","commonSituations":"An executable truncated during download/copy; a packer/protector that intentionally sets large SizeOfRawData; a corrupt copy where trailing sections were dropped; loading a file that is not actually a PE but passed earlier checks.","solutions":["Re-obtain the binary (re-download/rebuild) — a section claiming data past EOF means the file is incomplete.","Before parsing, sanity-check that file length is at least the maximum section PointerToRawData+SizeOfRawData.","If you control the parser, clamp SizeOfRawData to the available bytes and decode only what exists, rather than throwing.","Catch PEImageParseException and report 'corrupt or truncated PE' to the user."],"exampleFix":"// before\nif (Header.PointerToRawData + Header.SizeOfRawData <= originalImage.Length)\n    Data = originalImage.GetBytes((int)Header.PointerToRawData, (int)Header.SizeOfRawData);\nelse throw new PEImageParseException(int.MinValue, \"Section '\" + Header.Name + \"' incomplete.\");\n\n// after — read whatever is actually present\nint avail = Math.Max(0, originalImage.Length - (int)Header.PointerToRawData);\nData = originalImage.GetBytes((int)Header.PointerToRawData, Math.Min((int)Header.SizeOfRawData, avail));","handlingStrategy":"validation","validationCode":"long maxEnd = sections.Max(s => (long)s.Header.PointerToRawData + s.Header.SizeOfRawData);\nif (maxEnd > originalImage.Length) { /* truncated PE; do not call SetDataFromRsrc for overrunning sections */ }","typeGuard":null,"tryCatchPattern":"try { section.SetDataFromRsrc(originalImage); }\ncatch (PEImageParseException) { /* skip section */ }","preventionTips":["Pre-validate section raw ranges against file length.","Re-acquire truncated executables before parsing.","Clamp SizeOfRawData to available bytes for tolerant parsing."],"tags":["pe","exe","binary-parsing","truncation","section"],"backgroundTag":null,"analyzedSha":"cb5d9c429c81d9796fac469da2a68efb5626946d","analyzedAt":"2026-08-13T11:51:01.370Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}