{"record":{"id":"be605e0301cbeb69","repo":"golang/go","slug":"symbol-s-section-number-d-is-larger-than-max-d","errorCode":null,"errorMessage":"symbol %s: section number %d is larger than max %d","messagePattern":"symbol (.+?): section number (.+?) is larger than max (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/internal/objfile/pe.go","lineNumber":162,"sourceCode":"\tsect := f.pe.Section(\".text\")\n\tif sect == nil {\n\t\treturn 0, nil, fmt.Errorf(\"text section not found\")\n\t}\n\ttextStart = imageBase + uint64(sect.VirtualAddress)\n\ttext, err = sect.Data()\n\treturn\n}\n\nfunc findPESymbol(f *pe.File, name string) (*pe.Symbol, error) {\n\tfor _, s := range f.Symbols {\n\t\tif s.Name != name {\n\t\t\tcontinue\n\t\t}\n\t\tif s.SectionNumber <= 0 {\n\t\t\treturn nil, fmt.Errorf(\"symbol %s: invalid section number %d\", name, s.SectionNumber)\n\t\t}\n\t\tif len(f.Sections) < int(s.SectionNumber) {\n\t\t\treturn nil, fmt.Errorf(\"symbol %s: section number %d is larger than max %d\", name, s.SectionNumber, len(f.Sections))\n\t\t}\n\t\treturn s, nil\n\t}\n\treturn nil, fmt.Errorf(\"no %s symbol found\", name)\n}\n\nfunc loadPETable(f *pe.File, sname, ename string) ([]byte, error) {\n\tssym, err := findPESymbol(f, sname)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tesym, err := findPESymbol(f, ename)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif ssym.SectionNumber != esym.SectionNumber {\n\t\treturn nil, fmt.Errorf(\"%s and %s symbols must be in the same section\", sname, ename)\n\t}","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/internal/objfile/pe.go#L144-L180","documentation":"In `findPESymbol`, after validating that `SectionNumber > 0`, the code checks that it does not exceed the actual number of sections in the PE file (`len(f.Sections)`). If the symbol references a section number beyond the section table's bounds, this error fires. It indicates a corrupt PE symbol table where section indices are inconsistent with the section header table.","triggerScenarios":"Calling `findPESymbol` on a PE binary where a symbol's `SectionNumber` is larger than the number of sections declared in the PE section header table. This is a structural inconsistency typical of corrupt binaries, PE files produced by buggy tools, or binaries that were manually edited.","commonSituations":"Analyzing a corrupt Windows binary. Using a PE file that was truncated (section headers removed but symbol table not updated). Binary post-processing tools that modify section counts without updating symbol references. Malware analysis where the PE was deliberately malformed.","solutions":["Verify PE structural integrity with `dumpbin /headers` or a PE analysis tool — check section count consistency.","Rebuild the binary from source with a reliable linker.","If doing malware analysis, handle the error as expected behavior for malformed PEs.","Re-download the binary if it was transferred over an unreliable channel."],"exampleFix":"// before — corrupt PE with inconsistent section indices\nf, err := objfile.Open(\"malformed.exe\")\n_, err := findPESymbol(f.pe, \"runtime.pclntab\")  // fails: section number > max\n\n// after — rebuild from source\n$ go build -o app.exe ./...\nf, err := objfile.Open(\"app.exe\")  // succeeds","handlingStrategy":"validation","validationCode":"// Validate section count consistency in PE\nfunc validatePESectionConsistency(path string) error {\n    f, err := pe.Open(path)\n    if err != nil { return err }\n    defer f.Close()\n    for _, s := range f.Symbols {\n        if s.SectionNumber > 0 && int(s.SectionNumber) > len(f.Sections) {\n            return fmt.Errorf(\"corrupt PE: symbol %s references nonexistent section %d\", s.Name, s.SectionNumber)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"sym, err := findPESymbol(pe, name)\nif err != nil && strings.Contains(err.Error(), \"larger than max\") {\n    return fmt.Errorf(\"corrupt PE binary — section/symbol table inconsistency: %w\", err)\n}","preventionTips":["Verify PE structural integrity with dumpbin or pev.","Rebuild corrupt binaries from source.","Use file checksums to detect modifications or truncation."],"tags":["pe","windows","symbol-table","corrupt-binary","objfile"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}