{"record":{"id":"c92bd3374a13cc22","repo":"go-delve/delve","slug":"string-starting-at-x-of-size-x-is-past-the-end","errorCode":null,"errorMessage":"string starting at %#x of size %#x is past the end of file, while %s","messagePattern":"string starting at %#x of size %#x is past the end of file, while (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proc/core/minidump/minidump.go","lineNumber":518,"sourceCode":"\t}\n\tend := off + int(sz)\n\tif off >= len(buf.buf) || end > len(buf.buf) {\n\t\tbuf.err = fmt.Errorf(\"location starting at %#x of size %#x is past the end of file, while %s\", off, sz, buf.ctx)\n\t\treturn 0, nil\n\t}\n\trawData = buf.buf[off:end]\n\treturn\n}\n\nfunc readString(buf *minidumpBuf) string {\n\tstartOff := buf.off\n\tsz := buf.u32()\n\tif buf.err != nil {\n\t\treturn \"\"\n\t}\n\tend := buf.off + int(sz)\n\tif buf.off >= len(buf.buf) || end > len(buf.buf) {\n\t\tbuf.err = fmt.Errorf(\"string starting at %#x of size %#x is past the end of file, while %s\", startOff, sz, buf.ctx)\n\t\treturn \"\"\n\t}\n\treturn decodeUTF16(buf.buf[buf.off:end])\n}\n\n// readThreadList reads a thread list stream and adds the threads to the minidump.\nfunc readThreadList(mdmp *Minidump, buf *minidumpBuf) {\n\tthreadNum := buf.u32()\n\tif buf.err != nil {\n\t\treturn\n\t}\n\n\tmdmp.Threads = make([]Thread, threadNum)\n\n\tfor i := range mdmp.Threads {\n\t\tbuf.ctx = fmt.Sprintf(\"reading thread list entry %d\", i)\n\t\tthread := &mdmp.Threads[i]\n","sourceCodeStart":500,"sourceCodeEnd":536,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/pkg/proc/core/minidump/minidump.go#L500-L536","documentation":"When parsing a MINIDUMP_STRING, the reader reads a 4-byte length in bytes, then checks that buf.off+sz stays inside the file. If the UTF-16 string extends past the end of the file, parsing is aborted with this error. Like the memory-range variant, it indicates a truncated or corrupt dump whose string offsets no longer fit.","triggerScenarios":"proc.LoadMiniDumpFile encounters a MINIDUMP_STRING (module names, OS description in SystemInfoStream, etc.) whose declared byte size runs past EOF: buf.off >= len(buf.buf) or buf.off+sz > len(buf.buf).","commonSituations":"Partial file transfer, dump cut off while being written, corruption from email/zip transfer, or a faultily crafted dump with bogus string sizes.","solutions":["Obtain an intact copy of the minidump and verify its size/hash against the source machine.","Validate the dump with WinDbg/dumpchk to pinpoint the corrupted stream.","Re-capture the dump with a reliable method (procdump, Task Manager 'Create dump file') and confirm it finished.","For untrusted dumps, pre-scan with a minidump library that validates string RVAs before loading."],"exampleFix":"// before\n_, err := proc.LoadMiniDumpFile(\"part.dmp\", nil, 0) // string starting at 0x1a2b0 of size 0x1c is past the end of file\n\n// after: transfer again and check integrity\nsum, _ := hashFile(\"part.dmp\")\nif sum != expectedMD5 { reDownload(\"part.dmp\") }","handlingStrategy":"validation","validationCode":"// Pre-scan MINIDUMP_STRING RVAs with a lenient parser before loading:\nfunc stringsWithinFile(path string) error {\n    data, err := os.ReadFile(path)\n    if err != nil { return err }\n    // every RVA+size recorded in the dump must satisfy rva+size <= len(data)\n    return validateAllStringRVAs(data)\n}","typeGuard":null,"tryCatchPattern":"_, err := proc.LoadMiniDumpFile(path, nil, 0)\nif err != nil {\n    if strings.Contains(err.Error(), \"string starting at\") {\n        return fmt.Errorf(\"dump contains corrupt/truncated string data; obtain a fresh dump: %w\", err)\n    }\n    return err\n}","preventionTips":["Treat dumps as binary artifacts: always hash-verify after transfers.","Never hand-edit or patch dump files; regenerate instead.","When generating dumps, let MiniDumpWriteDump complete and confirm the final file size.","For untrusted dumps, validate with an independent minidump library first."],"tags":["minidump","corrupt-file","utf16","truncated"],"backgroundTag":"minidump-offset-past-eof","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}