dotnet/wpf · error · FileFormatException

SR.CFRCorrupt

Error message

SR.CFRCorrupt

What it means

CompoundFileReference.Load reads an Int32 entry count from the serialized reference; a negative count is impossible in a well-formed reference, so Load throws FileFormatException(SR.CFRCorrupt). This guards the reader against corrupt or maliciously crafted compound files whose reference records claim invalid entry counts.

Solutions

  1. Re-obtain the file from a trusted source; the reference record is corrupt.
  2. Locate the first parse error — negative counts usually mean the reader is misaligned from an earlier bad read.
  3. If you write these files, verify your reference serialization writes a non-negative entry count.
  4. Run a compound-file validator/repair tool to pinpoint corruption.

Example fix

// consumer-side guard before opening untrusted files
if (!CompoundFileLooksPlausible(stream))
    throw new InvalidDataException("compound file reference section is malformed");
var cf = CompoundFile.Open(stream);
Defensive patterns

Strategy: validation

Validate before calling

bool EntryCountLooksValid(byte[] record) { int c = BitConverter.ToInt32(record, EntryCountOffset); return c >= 0 && c < 4096; }

Try / catch

try { var r = CompoundFileReference.Load(reader); } catch (FileFormatException) { QuarantineFile(sourcePath); }

Prevention

When it happens

Trigger: Load deserializes a reference where the Int32 at the entry-count position is negative — bytes shifted by an earlier mis-parse, file truncation landing the reader mid-data, or a crafted file with a negative count.

Common situations: Opening damaged compound documents (disk corruption, bad downloads); files produced by writers with mismatched reference serialization format; security fuzzing of OPC packages.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/b8da2b9995550998. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/CompoundFileReference.cs:168

        /// <remarks>
        /// Side effect of change the stream pointer
        /// </remarks>
        /// <exception cref="FileFormatException">Throws a FileFormatException if any formatting errors are encountered</exception>
        internal static CompoundFileReference Load(BinaryReader reader, out int bytesRead)
        {
            ContainerUtilities.CheckAgainstNull( reader, "reader" );

            bytesRead = 0;  // running count of how much we've read - sanity check

            // create the TypeMap
            // reconstitute ourselves from the given BinaryReader
            
            // in this version, the next Int32 is the number of entries
            Int32 entryCount = reader.ReadInt32();
            bytesRead += ContainerUtilities.Int32Size;
            // EntryCount of zero indicates the root storage.
            if (entryCount < 0)
                throw new FileFormatException(
                    SR.CFRCorrupt);

            // need a temp collection because we don't know what we're dealing with until a non-storage component
            // type is encountered
            StringCollection storageList = null;
            String streamName = null;

            // loop through the entries - accumulating strings until we know what kind of object
            // we ultimately need
            int byteLength;     // reusable
            while (entryCount > 0)
            {
                // first Int32 tells us what kind of component this entry represents
                RefComponentType refType = (RefComponentType)reader.ReadInt32();
                bytesRead += ContainerUtilities.Int32Size;

                switch (refType)
                {

View on GitHub (pinned to 81131a70a4)