{"record":{"id":"641b5839a57cf63e","repo":"t8y2/dbx","slug":"unexpected-end-of-pe-file","errorCode":null,"errorMessage":"unexpected end of PE file","messagePattern":"unexpected end of PE file","errorType":"exception","errorClass":"PeFormatError","httpStatus":null,"severity":"error","filePath":"agents/scripts/validate_windows_pe_dependencies.py","lineNumber":14,"sourceCode":"#!/usr/bin/env python3\n\nimport argparse\nimport struct\nfrom pathlib import Path\n\n\nclass PeFormatError(ValueError):\n    pass\n\n\ndef _read_u16(data: bytes, offset: int) -> int:\n    if offset < 0 or offset + 2 > len(data):\n        raise PeFormatError(\"unexpected end of PE file\")\n    return struct.unpack_from(\"<H\", data, offset)[0]\n\n\ndef _read_u32(data: bytes, offset: int) -> int:\n    if offset < 0 or offset + 4 > len(data):\n        raise PeFormatError(\"unexpected end of PE file\")\n    return struct.unpack_from(\"<I\", data, offset)[0]\n\n\ndef _read_c_string(data: bytes, offset: int) -> str:\n    if offset < 0 or offset >= len(data):\n        raise PeFormatError(\"PE string offset is outside the file\")\n    end = data.find(b\"\\0\", offset)\n    if end < 0:\n        raise PeFormatError(\"unterminated PE string\")\n    try:\n        return data[offset:end].decode(\"ascii\")\n    except UnicodeDecodeError as error:","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/scripts/validate_windows_pe_dependencies.py#L1-L32","documentation":"The Windows PE dependency validator parses PE binary structures with bounded reads. _read_u16 raises PeFormatError('unexpected end of PE file') when a 2-byte read at the given offset would run past the end of the loaded data (or offset is negative), meaning the file is truncated or not a valid PE image.","triggerScenarios":"imported_dlls calls _read_u16 with an offset within 2 bytes of the buffer end — typically because the file being validated is truncated, still downloading, or is not actually a PE (EXE/DLL) file so structure offsets are meaningless.","commonSituations":"Validating a partially downloaded installer; pointing the validator at a text file, ZIP, or Mach-O/ELF binary by mistake; virus scanner or transfer tool truncated the DLL; corrupt artifact from a broken CI upload.","solutions":["Re-download or rebuild the PE file — it is truncated or corrupted.","Verify the file is a real Windows PE (starts with 'MZ', reasonable size) before validating.","Check file size against the expected artifact size/checksum from the release manifest.","Ensure the validator is pointed at a Windows binary, not an ELF/Mach-O or archive."],"exampleFix":"# before\nvalidate_windows_pe_dependencies.py path/to/partial-download.dll\n# after\nverify checksum of the artifact, re-download, then validate_windows_pe_dependencies.py path/to/file.dll","handlingStrategy":"validation","validationCode":"def looks_like_pe(path, min_size=64):\n    data = path.read_bytes()\n    return len(data) >= min_size and data[:2] == b\"MZ\"\n\nif not looks_like_pe(Path(dll_path)):\n    raise SystemExit(f\"{dll_path} is not a valid PE file\")","typeGuard":"def is_pe(data: bytes) -> bool:\n    return len(data) >= 64 and data[:2] == b\"MZ\"","tryCatchPattern":"try:\n    dlls = imported_dlls(path)\nexcept PeFormatError as e:\n    print(f\"skipping {path}: {e}\")","preventionTips":["Verify checksums/sizes of downloaded Windows binaries","Only run the validator on PE (MZ-header) files","Re-download truncated artifacts","Exclude non-Windows binaries from validation batches"],"tags":["python","pe-format","windows","binary-parsing","truncated-file"],"backgroundTag":"pe-parse-error","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}