{"record":{"id":"85b8bdf65282179b","repo":"oven-sh/bun","slug":"securitydirinsideimage","errorCode":null,"errorMessage":"SecurityDirInsideImage","messagePattern":"SecurityDirInsideImage","errorType":"console","errorClass":"bun_exe_format::pe::Error","httpStatus":null,"severity":"error","filePath":"src/exe_format/pe.rs","lineNumber":35,"sourceCode":"    #[error(\"InvalidPEFile\")]\n    InvalidPEFile,\n    #[error(\"InvalidDOSSignature\")]\n    InvalidDOSSignature,\n    #[error(\"InvalidPESignature\")]\n    InvalidPESignature,\n    #[error(\"UnsupportedPEFormat\")]\n    UnsupportedPEFormat,\n    #[error(\"InsufficientHeaderSpace\")]\n    InsufficientHeaderSpace,\n    #[error(\"TooManySections\")]\n    TooManySections,\n    #[error(\"SectionExists\")]\n    SectionExists,\n    #[error(\"InputIsSigned\")]\n    InputIsSigned,\n    #[error(\"InvalidSecurityDirectory\")]\n    InvalidSecurityDirectory,\n    #[error(\"SecurityDirInsideImage\")]\n    SecurityDirInsideImage,\n    #[error(\"UnexpectedOverlayPresent\")]\n    UnexpectedOverlayPresent,\n    #[error(\"InsufficientSpace\")]\n    InsufficientSpace,\n}\n\n/// Windows PE Binary manipulation for codesigning standalone executables\npub struct PEFile {\n    pub(crate) data: Vec<u8>,\n    // Store offsets instead of pointers to avoid invalidation after resize\n    pub(crate) pe_header_offset: usize,\n    pub(crate) optional_header_offset: usize,\n    pub(crate) section_headers_offset: usize,\n    pub(crate) num_sections: u16,\n}\n\n// PE/COFF on-disk header structs are byte-packed (no padding) per spec, and may","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/exe_format/pe.rs#L17-L53","documentation":"The Security directory's certificate table starts before the end of the last section's raw data (src/exe_format/pe.rs:378-380), i.e. the 'signature' overlaps the image itself. Per the PE spec the certificate table lives after all sections; an offset inside the image means the directory is corrupt or malicious, and removing that range would destroy section content.","triggerScenarios":"strip_authenticode (called from add_bun_section during `bun build --compile --target=windows`) computes last_raw_end = max(PointerToRawData + SizeOfRawData) over sections and finds sec_off < last_raw_end.","commonSituations":"Malformed or packed executables whose section table was rewritten without relocating the certificate table; malware-style PEs that deliberately point the security directory into .text; corrupted build artifacts from faulty code-signing pipelines.","solutions":["Use an unmodified, unsigned stock Bun executable as the compile base.","Strip the bogus signature from the custom base with `osslsigncode remove-signature` (it rewrites the directory) and retry.","Inspect the base with `dumpbin /headers` / `/sections` to confirm the certificate table offset is beyond every section's raw end.","If the base is third-party and unrepairable, treat it as untrusted — do not use it to produce your distributable."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"python -c \"\nimport pefile\npe = pefile.PE('base.exe')\nlast = max((s.PointerToRawData + s.SizeOfRawData) for s in pe.sections)\nsd = pe.OPTIONAL_HEADER.DATA_DIRECTORY[4]\nassert sd.VirtualAddress == 0 or sd.VirtualAddress >= last, 'cert table overlaps image'\n\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Don't use packed or rewritten PEs with relocated-but-unmoved cert tables as bases","Strip signatures on a clean copy with osslsigncode before injecting","Treat any base whose security dir points into .text as corrupt/untrusted"],"tags":["windows","pe","authenticode","codesigning","corruption"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}