View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000692 | file | General | public | 2025-11-06 12:22 | 2025-11-06 12:22 |
| Reporter | adepasquale | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | new | Resolution | open | ||
| Product Version | 5.41 | ||||
| Summary | 0000692: RFC 822 file identified as "data" after "FE FF 00" | ||||
| Description | I have an email file with a PDF attachment in plaintext encoding. "Received:" is at offset zero so it should be recognized as RFC 822. The PDF within the email contains some null bytes in the /Producer tag. Note that the issue happens after the FEFF00 sequence. The first FEFF does not cause misidentification | ||||
| Steps To Reproduce | $ file sample.eml sample.eml: data $ xxd -l 0x1af sample.eml | xxd -r | file - /dev/stdin: RFC 822 mail text, ISO-8859 text, with CRLF line terminators $ xxd -l 0x1b0 sample.eml | xxd -r | file - /dev/stdin: data | ||||
| Additional Information | $ xxd -s 0x17c sample.eml 0000017c: 2550 4446 2d31 2e34 0d0a 3120 3020 6f62 %PDF-1.4..1 0 ob 0000018c: 6a0d 0a3c 3c0d 0a2f 4372 6561 746f 7220 j..<<../Creator 0000019c: 28fe ff29 0d0a 2f50 726f 6475 6365 7220 (..)../Producer 000001ac: 28fe ff00 5100 7400 2000 3500 2e00 3500 (...Q.t. .5...5. 000001bc: 2e00 3129 0d0a 3e3e 0d0a ..1)..>>.. | ||||
| Tags | No tags attached. | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-11-06 12:22 | adepasquale | New Issue | |
| 2025-11-06 12:22 | adepasquale | File Added: sample.eml |
