{"record":{"id":"6c564a2e57c35a03","repo":"dotnet/wpf","slug":"sr-cfrcorruptmultistream","errorCode":null,"errorMessage":"SR.CFRCorruptMultiStream","messagePattern":"SR\\.CFRCorruptMultiStream","errorType":"exception","errorClass":"FileFormatException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/CompoundFileReference.cs","lineNumber":203,"sourceCode":"                switch (refType)\n                {\n                    case RefComponentType.Storage:\n                    {\n                        if (streamName != null)\n                            throw new FileFormatException(\n                                SR.CFRCorruptStgFollowStm);\n\n                        if (storageList == null)\n                            storageList = new StringCollection();\n\n                        String str = ContainerUtilities.ReadByteLengthPrefixedDWordPaddedUnicodeString(reader, out byteLength);\n                        bytesRead += byteLength;\n                        storageList.Add(str);\n} break;\n                    case RefComponentType.Stream:\n                    {\n                        if (streamName != null)\n                            throw new FileFormatException(\n                                SR.CFRCorruptMultiStream);\n\n                        streamName = ContainerUtilities.ReadByteLengthPrefixedDWordPaddedUnicodeString(reader, out byteLength);\n                        bytesRead += byteLength;\n                    } break;\n\n                    // we don't handle these types yet\n                    default:\n                        throw new FileFormatException(\n                            SR.UnknownReferenceComponentType);\n                }\n\n                --entryCount;\n            }\n\n            CompoundFileReference newRef = null;\n\n            // stream or storage?","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/CompoundFileReference.cs#L185-L221","documentation":"CompoundFileReference.Load() parses a serialized reference and found a second Stream component in a single reference entry, which the format forbids. A valid compound-file reference may name at most one storage and one stream; encountering a second stream means the serialized data is malformed or truncated/corrupted. The library fails fast with FileFormatException rather than misinterpreting the bytes.","triggerScenarios":"Calling CompoundFileReference.Load (or loading a compound-file container that stores references) over a byte stream whose reference record lists Stream component type more than once for one entry.","commonSituations":"Hand-edited or corrupted compound files, files produced by buggy third-party writers, files truncated by incomplete downloads or transfer in text mode, or fuzzed input to code that opens XPS/compound-file packages.","solutions":["Verify the file is not corrupted: re-obtain it from the source and compare checksums or re-download in binary mode.","Validate that the file was written by a conformant compound-file writer; re-generate it with the official packaging APIs (System.IO.Packaging / ZipPackage or valid OCG/CPF writer).","Wrap the Load call in try/catch for FileFormatException and treat it as invalid input, showing a user-facing 'file is corrupted' message.","If constructing references programmatically, do not serialize multiple Stream components into one reference."],"exampleFix":"// before\nvar reference = CompoundFileReference.Load(binaryReader); // throws FileFormatException on corrupt data\n// after\nCompoundFileReference reference;\ntry { reference = CompoundFileReference.Load(binaryReader); }\ncatch (FileFormatException) { throw new InvalidDataException(\"The compound file reference data is corrupt.\"); }","handlingStrategy":"try-catch","validationCode":"if (reader.BaseStream.Length - reader.BaseStream.Position < 8) throw new InvalidDataException(\"Not enough bytes for a compound-file reference.\");","typeGuard":"static bool IsValidCompoundFileData(Stream s) => s != null && s.CanRead && s.Length > 0;","tryCatchPattern":"try { var r = CompoundFileReference.Load(reader); }\ncatch (FileFormatException ex) { log.Warn(ex, \"Corrupt compound-file reference\"); throw new InvalidDataException(\"File is corrupt.\", ex); }","preventionTips":["Verify file integrity (checksum/hash) before opening compound files","Always transfer/store these files in binary mode","Re-download corrupted files from the source instead of retrying","Only write compound files with the official packaging APIs"],"tags":["file-corruption","fileformat","wpf","packaging"],"backgroundTag":"schema-validation-failed","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}