oven-sh/bun · error · bun_exe_format::pe::Error

SecurityDirInsideImage

Error message

SecurityDirInsideImage

What it means

The Security directory's certificate table starts before the end of the last section's raw data (src/exe_format/pe.rs:378-380), i.e. the 'signature' overlaps the image itself. Per the PE spec the certificate table lives after all sections; an offset inside the image means the directory is corrupt or malicious, and removing that range would destroy section content.

Source

Thrown at src/exe_format/pe.rs:35

    #[error("InvalidPEFile")]
    InvalidPEFile,
    #[error("InvalidDOSSignature")]
    InvalidDOSSignature,
    #[error("InvalidPESignature")]
    InvalidPESignature,
    #[error("UnsupportedPEFormat")]
    UnsupportedPEFormat,
    #[error("InsufficientHeaderSpace")]
    InsufficientHeaderSpace,
    #[error("TooManySections")]
    TooManySections,
    #[error("SectionExists")]
    SectionExists,
    #[error("InputIsSigned")]
    InputIsSigned,
    #[error("InvalidSecurityDirectory")]
    InvalidSecurityDirectory,
    #[error("SecurityDirInsideImage")]
    SecurityDirInsideImage,
    #[error("UnexpectedOverlayPresent")]
    UnexpectedOverlayPresent,
    #[error("InsufficientSpace")]
    InsufficientSpace,
}

/// Windows PE Binary manipulation for codesigning standalone executables
pub struct PEFile {
    pub(crate) data: Vec<u8>,
    // Store offsets instead of pointers to avoid invalidation after resize
    pub(crate) pe_header_offset: usize,
    pub(crate) optional_header_offset: usize,
    pub(crate) section_headers_offset: usize,
    pub(crate) num_sections: u16,
}

// PE/COFF on-disk header structs are byte-packed (no padding) per spec, and may

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Use an unmodified, unsigned stock Bun executable as the compile base.
2. Strip the bogus signature from the custom base with `osslsigncode remove-signature` (it rewrites the directory) and retry.
3. Inspect the base with `dumpbin /headers` / `/sections` to confirm the certificate table offset is beyond every section's raw end.
4. If the base is third-party and unrepairable, treat it as untrusted — do not use it to produce your distributable.

python -c "
import pefile
pe = pefile.PE('base.exe')
last = max((s.PointerToRawData + s.SizeOfRawData) for s in pe.sections)
sd = pe.OPTIONAL_HEADER.DATA_DIRECTORY[4]
assert sd.VirtualAddress == 0 or sd.VirtualAddress >= last, 'cert table overlaps image'
"

When it happens

Trigger: strip_authenticode (called from add_bun_section during `bun build --compile --target=windows`) computes last_raw_end = max(PointerToRawData + SizeOfRawData) over sections and finds sec_off < last_raw_end.

Common situations: Malformed or packed executables whose section table was rewritten without relocating the certificate table; malware-style PEs that deliberately point the security directory into .text; corrupted build artifacts from faulty code-signing pipelines.

Related errors

• InputIsSigned
• InvalidSecurityDirectory
• InvalidPESignature
• UnsupportedPEFormat
• InsufficientHeaderSpace

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/85b8bdf65282179b. Report an issue: GitHub.