Skip to content

Clean up matches for OLE/CFB based Word files

The changed matches are for OLE files, thus should depend on the header magic.

The "MSWordDoc" match is the AnsiClipboardFormat of the CompObjStream. It can be made more specific by adding the length bytes and trailing null byte. Change the offset to a range, the minimum offset from the sector start is 28 bytes header + 4 bytes for the preceding displayname length, but can be larger is there is a displayname (typically ~24..32 characters). See [MS-OLEDS] specification for details.

The "bjbj" match is quite arbitrary. Although it matches the "office.doc" testfile, these bytes inside the Word FIB are "reserved" and vary between different implementations. Replace it with the preceding FIB 0xa5ec magic, and the high byte from the following nFib version field.

Merge request reports