{"record":{"id":"579477f1ae2d56f7","repo":"golang/go","slug":"scanning-pe-for-fips-magic-v","errorCode":null,"errorMessage":"scanning PE for FIPS magic: %v","messagePattern":"scanning PE for FIPS magic: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/link/internal/ld/fips140.go","lineNumber":518,"sourceCode":"\n\t// Find the go:fipsinfo symbol.\n\t// PE does not put it in its own section, so we have to scan for it.\n\t// It is near the start of the data segment, right after go:buildinfo,\n\t// so we should not have to scan too far.\n\tconst maxScan = 16 << 20\n\tsect := pf.Section(\".data\")\n\tif sect == nil {\n\t\treturn fmt.Errorf(\"cannot find .data\")\n\t}\n\tb := bufio.NewReader(sect.Open())\n\toff := int64(0)\n\tdata := make([]byte, fipsMagicLen+fipsSumLen+9*ctxt.Arch.PtrSize)\n\tfor ; ; off += 16 {\n\t\tif off >= maxScan {\n\t\t\tbreak\n\t\t}\n\t\tif _, err := io.ReadFull(b, data[:fipsMagicLen]); err != nil {\n\t\t\treturn fmt.Errorf(\"scanning PE for FIPS magic: %v\", err)\n\t\t}\n\t\tif string(data[:fipsMagicLen]) == fipsMagic {\n\t\t\tif _, err := io.ReadFull(b, data[fipsMagicLen:]); err != nil {\n\t\t\t\treturn fmt.Errorf(\"scanning PE for FIPS magic: %v\", err)\n\t\t\t}\n\t\t\tbreak\n\t\t}\n\t}\n\n\tuptr := ctxt.Arch.ByteOrder.Uint64\n\tif ctxt.Arch.PtrSize == 4 {\n\t\tuptr = func(x []byte) uint64 {\n\t\t\treturn uint64(ctxt.Arch.ByteOrder.Uint32(x))\n\t\t}\n\t}\n\n\t// Add the sections listed in go:fipsinfo to the FIPS object.\n\t// Determine the base used for the self pointer, and then apply","sourceCodeStart":500,"sourceCodeEnd":536,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/link/internal/ld/fips140.go#L500-L536","documentation":"During PE FIPS post-link processing, the code scans the .data section in 16-byte increments looking for the FIPS magic bytes. This specific error (at line 518) fires when an I/O error occurs while reading the first fipsMagicLen bytes at the current scan offset. This is the initial magic-detection read within the scan loop.","triggerScenarios":"io.ReadFull(b, data[:fipsMagicLen]) is called inside the scan loop (off += 16). If it returns an error (e.g. EOF before fipsMagicLen bytes, or a read error from the bufio.Reader wrapping the section data), the error wraps the underlying I/O error.","commonSituations":"The .data section is shorter than expected (premature EOF); corrupted PE file with truncated section data; I/O errors reading the binary from disk; race condition where the binary is modified while being scanned; anti-virus software locking or modifying the file.","solutions":["Verify the binary file is not corrupted: re-run the build","Clean rebuild: go clean -cache && GOFIPS=1 go build","Check file permissions and ensure no other process is modifying the binary","Disable antivirus scanning temporarily to rule out file locking","Report as a Go linker bug if the issue persists with a clean build"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Handle I/O errors during FIPS magic scan\nif _, err := io.ReadFull(b, data[:fipsMagicLen]); err != nil {\n    if err == io.EOF || err == io.ErrUnexpectedEOF {\n        break // section ended before finding magic — not necessarily an error\n    }\n    return fmt.Errorf(\"scanning PE for FIPS magic: %w (check binary integrity)\", err)\n}","preventionTips":["Verify the binary file is complete and not corrupted","Ensure no other process (antivirus, build tools) is modifying the binary during linking","Run go clean -cache and rebuild if the binary appears truncated","Check disk health if I/O errors are persistent"],"tags":["fips","fips140","pe","linker","go-toolchain","io-error","windows"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}