fix: disambiguate legacy OLE DOC vs XLS detection (#178) - #179
Open
kryptobi wants to merge 1 commit into
Open
Conversation
DOC and XLS both share the generic OLE/CFBF header (D0 CF 11 E0 A1 B1 1A E1). DOC previously matched only this container signature, which could cause XLS files to be classified as DOC and lead to null from validated type lookup. Add a DOC-specific subheader check at offset 512: - EC A5 C1 00 This makes DOC detection stricter and prevents false positives for XLS files that match XLS-specific offset-512 signatures (e.g. FD FF FF FF ?? 00 / ?? 02). Add regression tests to verify: - OLE + XLS subheader matches XLS and does not match DOC - OLE + DOC subheader matches DOC issue: #178
Collaborator
Author
|
@rcaunt fyi |
TeQ2102
approved these changes
Jul 31, 2026
maxbreuker
approved these changes
Jul 31, 2026
Contributor
|
@kryptobi Tested with six legacy OLE/CFBF files. doc-word97.doc is detected as Doc as intended. The other five (Word 6/95, LibreOffice-written .doc and .xls, Excel-written .xls) return no match on this branch, where they returned Doc on main. Files and console output attached. 
|
Collaborator
Author
Ok thanks max, i will checks this |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DOC and XLS both share the generic OLE/CFBF header (D0 CF 11 E0 A1 B1 1A E1). DOC previously matched only this container signature, which could cause XLS files to be classified as DOC and lead to null from validated type lookup.
Add a DOC-specific subheader check at offset 512:
This makes DOC detection stricter and prevents false positives for XLS files that match XLS-specific offset-512 signatures (e.g. FD FF FF FF ?? 00 / ?? 02).
Add regression tests to verify:
issue: #178