[GH-ISSUE #2191] [Bug] Malformed PE section headers make managed inspection report execution_failure instead of invalid input #735

New issue

Closed

opened 2026-10-15 18:27:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:27:48 +00:00

Owner

Originally created by @kaoru0822-kitauji on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2191

Observed behavior

When a PE's section headers are malformed, inspect-managed-artifact and inspect-managed-members return a generic execution_failure that tells the caller to run rea doctor. The other PE readers report the same file as invalid input with the exact range problem:

# Microsoft.PowerShell.Pager.dll (from VS Code) with its first section's PointerToRawData set past EOF
inspect-managed-artifact:  execution_failure | Analysis could not complete. Run `rea doctor` and review the reported details; …   details: {"provider_id":"rea-dotnet-static", …}
inspect-managed-members:   execution_failure | (same)
inspect-pe-resources:      invalid_request   | issues: [{"reason":"invalid_format","message":"PE range 20880 + 4608 leaves the artifact."}]
inspect-go-binary:         invalid_request   | issues: [{"reason":"invalid_format","message":"Selected artifact …: …"}]

The underlying error is precise: ManagedReaderFailure: pe.section-data leaves the artifact byte range, raised by readSections in readManagedPeLayout. It is lost before reaching the caller.

Reproduction

import struct
d = bytearray(open("Microsoft.PowerShell.Pager.dll", "rb").read())
pe = struct.unpack_from("<I", d, 0x3c)[0]
sec = pe + 4 + 20 + struct.unpack_from("<H", d, pe + 20)[0]
struct.pack_into("<I", d, sec + 20, len(d) + 0x1000)   # first section PointerToRawData past EOF
open("section-past-eof.dll", "wb").write(d)

rea inspect-managed-artifact section-past-eof.dll --format json on main 5190843f8. Byte-mutation fuzzing of real managed DLLs hits the same path.

Expected behavior

An invalid_request / invalid_format issue that names the malformed PE structure, as inspect-pe-resources and inspect-go-binary report for the same bytes. Not a rea doctor recommendation.

Cause

readManagedPeLayout (src/dotnet/ManagedPeReader.ts) throws ManagedReaderFailure for DOS/COFF/section-header failures. inspectManagedArtifactBytes and inspectManagedMembersBytes only convert failures raised after the layout is read. ManagedStaticProvider.execute maps any non-AnalysisError to ProviderAdapterError, which is projected as execution_failure.

Originally created by @kaoru0822-kitauji on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2191 ### Observed behavior When a PE's section headers are malformed, `inspect-managed-artifact` and `inspect-managed-members` return a generic `execution_failure` that tells the caller to run `rea doctor`. The other PE readers report the same file as invalid input with the exact range problem: ```text # Microsoft.PowerShell.Pager.dll (from VS Code) with its first section's PointerToRawData set past EOF inspect-managed-artifact: execution_failure | Analysis could not complete. Run `rea doctor` and review the reported details; … details: {"provider_id":"rea-dotnet-static", …} inspect-managed-members: execution_failure | (same) inspect-pe-resources: invalid_request | issues: [{"reason":"invalid_format","message":"PE range 20880 + 4608 leaves the artifact."}] inspect-go-binary: invalid_request | issues: [{"reason":"invalid_format","message":"Selected artifact …: …"}] ``` The underlying error is precise: `ManagedReaderFailure: pe.section-data leaves the artifact byte range`, raised by `readSections` in `readManagedPeLayout`. It is lost before reaching the caller. ### Reproduction ```python import struct d = bytearray(open("Microsoft.PowerShell.Pager.dll", "rb").read()) pe = struct.unpack_from("<I", d, 0x3c)[0] sec = pe + 4 + 20 + struct.unpack_from("<H", d, pe + 20)[0] struct.pack_into("<I", d, sec + 20, len(d) + 0x1000) # first section PointerToRawData past EOF open("section-past-eof.dll", "wb").write(d) ``` `rea inspect-managed-artifact section-past-eof.dll --format json` on main 5190843f8. Byte-mutation fuzzing of real managed DLLs hits the same path. ### Expected behavior An `invalid_request` / `invalid_format` issue that names the malformed PE structure, as `inspect-pe-resources` and `inspect-go-binary` report for the same bytes. Not a `rea doctor` recommendation. ### Cause `readManagedPeLayout` (`src/dotnet/ManagedPeReader.ts`) throws `ManagedReaderFailure` for DOS/COFF/section-header failures. `inspectManagedArtifactBytes` and `inspectManagedMembersBytes` only convert failures raised after the layout is read. `ManagedStaticProvider.execute` maps any non-`AnalysisError` to `ProviderAdapterError`, which is projected as `execution_failure`.

bsakaguchi

2026-10-15 18:27:48 +00:00