head 1.1; branch 1.1.1; access; symbols FILE5_48:1.1.1.5 netbsd-11-0-RC4:1.1.1.4 netbsd-11-0-RC3:1.1.1.4 netbsd-11-0-RC2:1.1.1.4 netbsd-11-0-RC1:1.1.1.4 perseant-exfatfs-base-20250801:1.1.1.4 netbsd-11:1.1.1.4.0.10 netbsd-11-base:1.1.1.4 netbsd-10-1-RELEASE:1.1.1.4 perseant-exfatfs-base-20240630:1.1.1.4 perseant-exfatfs:1.1.1.4.0.8 perseant-exfatfs-base:1.1.1.4 netbsd-8-3-RELEASE:1.1.1.2 netbsd-9-4-RELEASE:1.1.1.2 netbsd-10-0-RELEASE:1.1.1.4 netbsd-10-0-RC6:1.1.1.4 netbsd-10-0-RC5:1.1.1.4 netbsd-10-0-RC4:1.1.1.4 netbsd-10-0-RC3:1.1.1.4 netbsd-10-0-RC2:1.1.1.4 netbsd-10-0-RC1:1.1.1.4 FILE5_45:1.1.1.4 netbsd-10:1.1.1.4.0.6 netbsd-10-base:1.1.1.4 FILE5_43:1.1.1.4 netbsd-9-3-RELEASE:1.1.1.2 cjep_sun2x-base1:1.1.1.4 cjep_sun2x:1.1.1.4.0.4 cjep_sun2x-base:1.1.1.4 cjep_staticlib_x-base1:1.1.1.4 netbsd-9-2-RELEASE:1.1.1.2 cjep_staticlib_x:1.1.1.4.0.2 cjep_staticlib_x-base:1.1.1.4 FILE5_40:1.1.1.4 netbsd-9-1-RELEASE:1.1.1.2 FILE5_39:1.1.1.3 phil-wifi-20200421:1.1.1.2 phil-wifi-20200411:1.1.1.2 is-mlppp:1.1.1.2.0.50 is-mlppp-base:1.1.1.2 phil-wifi-20200406:1.1.1.2 netbsd-8-2-RELEASE:1.1.1.2 netbsd-9-0-RELEASE:1.1.1.2 netbsd-9-0-RC2:1.1.1.2 FILE5_38:1.1.1.2 netbsd-9-0-RC1:1.1.1.2 phil-wifi-20191119:1.1.1.2 netbsd-9:1.1.1.2.0.48 netbsd-9-base:1.1.1.2 phil-wifi-20190609:1.1.1.2 netbsd-8-1-RELEASE:1.1.1.2 FILE5_37:1.1.1.2 netbsd-8-1-RC1:1.1.1.2 pgoyette-compat-merge-20190127:1.1.1.2 pgoyette-compat-20190127:1.1.1.2 pgoyette-compat-20190118:1.1.1.2 pgoyette-compat-1226:1.1.1.2 pgoyette-compat-1126:1.1.1.2 pgoyette-compat-1020:1.1.1.2 FILE5_35:1.1.1.2 pgoyette-compat-0930:1.1.1.2 pgoyette-compat-0906:1.1.1.2 netbsd-7-2-RELEASE:1.1.1.2 pgoyette-compat-0728:1.1.1.2 netbsd-8-0-RELEASE:1.1.1.2 phil-wifi:1.1.1.2.0.46 phil-wifi-base:1.1.1.2 pgoyette-compat-0625:1.1.1.2 netbsd-8-0-RC2:1.1.1.2 pgoyette-compat-0521:1.1.1.2 pgoyette-compat-0502:1.1.1.2 pgoyette-compat-0422:1.1.1.2 netbsd-8-0-RC1:1.1.1.2 FILE5_33:1.1.1.2 pgoyette-compat-0415:1.1.1.2 pgoyette-compat-0407:1.1.1.2 pgoyette-compat-0330:1.1.1.2 pgoyette-compat-0322:1.1.1.2 pgoyette-compat-0315:1.1.1.2 netbsd-7-1-2-RELEASE:1.1.1.2 pgoyette-compat:1.1.1.2.0.44 pgoyette-compat-base:1.1.1.2 netbsd-7-1-1-RELEASE:1.1.1.2 matt-nb8-mediatek:1.1.1.2.0.42 matt-nb8-mediatek-base:1.1.1.2 FILE5_32:1.1.1.2 perseant-stdc-iso10646:1.1.1.2.0.40 perseant-stdc-iso10646-base:1.1.1.2 netbsd-8:1.1.1.2.0.38 netbsd-8-base:1.1.1.2 FILE5_31:1.1.1.2 prg-localcount2-base3:1.1.1.2 prg-localcount2-base2:1.1.1.2 prg-localcount2-base1:1.1.1.2 prg-localcount2:1.1.1.2.0.36 prg-localcount2-base:1.1.1.2 pgoyette-localcount-20170426:1.1.1.2 bouyer-socketcan-base1:1.1.1.2 pgoyette-localcount-20170320:1.1.1.2 netbsd-7-1:1.1.1.2.0.34 netbsd-7-1-RELEASE:1.1.1.2 netbsd-7-1-RC2:1.1.1.2 FILE5_30:1.1.1.2 netbsd-7-nhusb-base-20170116:1.1.1.2 bouyer-socketcan:1.1.1.2.0.32 bouyer-socketcan-base:1.1.1.2 pgoyette-localcount-20170107:1.1.1.2 netbsd-7-1-RC1:1.1.1.2 pgoyette-localcount-20161104:1.1.1.2 netbsd-7-0-2-RELEASE:1.1.1.2 localcount-20160914:1.1.1.2 netbsd-7-nhusb:1.1.1.2.0.30 netbsd-7-nhusb-base:1.1.1.2 pgoyette-localcount-20160806:1.1.1.2 pgoyette-localcount-20160726:1.1.1.2 pgoyette-localcount:1.1.1.2.0.28 pgoyette-localcount-base:1.1.1.2 netbsd-7-0-1-RELEASE:1.1.1.2 netbsd-7-0:1.1.1.2.0.26 netbsd-7-0-RELEASE:1.1.1.2 netbsd-7-0-RC3:1.1.1.2 netbsd-7-0-RC2:1.1.1.2 netbsd-7-0-RC1:1.1.1.2 FILE5_22:1.1.1.2 FILE5_20:1.1.1.2 netbsd-6-0-6-RELEASE:1.1.1.2 netbsd-6-1-5-RELEASE:1.1.1.2 netbsd-7:1.1.1.2.0.24 netbsd-7-base:1.1.1.2 FILE5_19:1.1.1.2 yamt-pagecache-base9:1.1.1.2 yamt-pagecache-tag8:1.1.1.2 netbsd-6-1-4-RELEASE:1.1.1.2 netbsd-6-0-5-RELEASE:1.1.1.2 tls-earlyentropy:1.1.1.2.0.22 tls-earlyentropy-base:1.1.1.2 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.2 riastradh-drm2-base3:1.1.1.2 netbsd-6-1-3-RELEASE:1.1.1.2 netbsd-6-0-4-RELEASE:1.1.1.2 FILE5_16:1.1.1.2 netbsd-6-1-2-RELEASE:1.1.1.2 netbsd-6-0-3-RELEASE:1.1.1.2 netbsd-6-1-1-RELEASE:1.1.1.2 riastradh-drm2-base2:1.1.1.2 riastradh-drm2-base1:1.1.1.2 riastradh-drm2:1.1.1.2.0.14 riastradh-drm2-base:1.1.1.2 netbsd-6-1:1.1.1.2.0.20 netbsd-6-0-2-RELEASE:1.1.1.2 netbsd-6-1-RELEASE:1.1.1.2 khorben-n900:1.1.1.2.0.18 netbsd-6-1-RC4:1.1.1.2 netbsd-6-1-RC3:1.1.1.2 agc-symver:1.1.1.2.0.16 agc-symver-base:1.1.1.2 FILE5_14:1.1.1.2 netbsd-6-1-RC2:1.1.1.2 netbsd-6-1-RC1:1.1.1.2 yamt-pagecache-base8:1.1.1.2 FILE_5_12:1.1.1.2 netbsd-6-0-1-RELEASE:1.1.1.2 yamt-pagecache-base7:1.1.1.2 matt-nb6-plus-nbase:1.1.1.2 yamt-pagecache-base6:1.1.1.2 netbsd-6-0:1.1.1.2.0.12 netbsd-6-0-RELEASE:1.1.1.2 netbsd-6-0-RC2:1.1.1.2 tls-maxphys:1.1.1.2.0.10 tls-maxphys-base:1.1.1.2 matt-nb6-plus:1.1.1.2.0.8 matt-nb6-plus-base:1.1.1.2 netbsd-6-0-RC1:1.1.1.2 yamt-pagecache-base5:1.1.1.2 yamt-pagecache-base4:1.1.1.2 FILE5_11:1.1.1.2 netbsd-6:1.1.1.2.0.6 netbsd-6-base:1.1.1.2 yamt-pagecache-base3:1.1.1.2 yamt-pagecache-base2:1.1.1.2 yamt-pagecache:1.1.1.2.0.4 yamt-pagecache-base:1.1.1.2 FILE5_09:1.1.1.2 cherry-xenmp:1.1.1.2.0.2 cherry-xenmp-base:1.1.1.2 FILE5_07:1.1.1.2 bouyer-quota2-nbase:1.1.1.1 bouyer-quota2:1.1.1.1.0.4 bouyer-quota2-base:1.1.1.1 matt-mips64-premerge-20101231:1.1.1.1 matt-premerge-20091211:1.1.1.1 jym-xensuspend-base:1.1.1.1 jym-xensuspend:1.1.1.1.0.2 jym-xensuspend-nbase:1.1.1.1 FILE5_03:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.1 date 2009.05.08.16.35.09; author christos; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2009.05.08.16.35.09; author christos; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; 1.1.1.2 date 2011.05.12.20.47.04; author christos; state Exp; branches; next 1.1.1.3; 1.1.1.3 date 2020.06.15.00.18.48; author christos; state Exp; branches; next 1.1.1.4; commitid HMbuXSjPojU5LfcC; 1.1.1.4 date 2021.04.09.18.58.02; author christos; state Exp; branches; next 1.1.1.5; commitid W9ddLLbSkHHinEOC; 1.1.1.5 date 2026.06.10.15.59.14; author christos; state Exp; branches; next ; commitid 3UWc0DrzTz7bHgJG; 1.1.1.1.2.1 date 2009.05.08.16.35.09; author jym; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2009.05.13.18.51.59; author jym; state Exp; branches; next ; desc @@ 1.1 log @Initial revision @ text @ #------------------------------------------------------------------------------ # rtf: file(1) magic for Rich Text Format (RTF) # # Duncan P. Simpson, D.P.Simpson@@dcs.warwick.ac.uk # 0 string {\\rtf Rich Text Format data, !:mime text/rtf >5 string 1 version 1, >>6 string \\ansi ANSI >>6 string \\mac Apple Macintosh >>6 string \\pc IBM PC, code page 437 >>6 string \\pca IBM PS/2, code page 850 >>6 default x unknown character set >5 default x unknown version @ 1.1.1.1 log @from ftp.astron.com @ text @@ 1.1.1.2 log @from ftp.astron.com. - many security related fixes - no MAXPATHLEN limits - fixed missing text specification on ascii magic - new ``pascal'' style string formats - whitespace comparison fix - more magic @ text @a2 1 # $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ @ 1.1.1.3 log @Import 5.39: * Remove unused subtype_mime (Steve Grubb) * Remove unused check in okstat (Steve Grubb) * Fix mime-type in elf binaries by making sure $x is set * Fix indirect negative offsets broken by OFFNEGATIVE * Fix GUID equality check * PR/165: Handle empty array and strings in JSON * PR/162: Add --exclude-quiet * Fix memory leak in ascmagic (Steve Grubb) * Fix string comparison length with ignore whitespace * Fix mingwin 64 compilation * PR/159: whitelist getpid needed for file_pipe2file() * Indicate negative offsets with a flag OFFNEGATIVE so that -0 works. * Introduce "offset" magic type that can be used to detect the file size, and bail on short files. * document DER better in the magic man page. * fix memory leaks (SonarQube) * rewrite confusing loops (SonarQube) * fix bogus test (SonarQube) * pass a sized buffer to file_fmttime() (SonarQube) * Don't allow * in printf formats, or the code itself (Christoph Biedl) * Introduce a printf output size checker to avoid DoS attacks * Avoid memory leak on error (oss-fuzz) * Check length of string on DER before derefercing and add new types * Add missing DER string (oss-fuzz) * Add missing DER types, and debugging * PR/140: Avoid abort with hand-crafted magic file (gockelhahn) * PR/139: Avoid DoS in printf with hand-crafted magic file (gockelhahn) * PR/138: Avoid crash with hand-crafted magic file (gockelhahn) * PR/136: Fix static build by adding a libmagic.pc (Fabrice Fontaine) * add guid support native support via the "guid" type. @ text @d3 1 a3 1 # $File: rtf,v 1.8 2020/05/17 19:28:49 christos Exp $ d7 2 a8 68 # Update: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/Rich_Text_Format # Reference: http://www.snake.net/software/RTF/RTF-Spec-1.7.rtf # http://www.kleinlercher.at/tools/Windows_Protocols/Word2007RTFSpec9.pdf 0 string {\\rtf # skip DROID fmt-355-signature-id-522.rtf by looking for valid version >5 ubyte !0xAB # skip also \ in DROID fmt-50-signature-id-158.rtf by looking for valid version >>5 ubyte !0x5C Rich Text Format data !:mime text/rtf !:apple ????RTF !:ext rtf >>>0 use rtf-info # display information like version, language and code page of RTF 0 name rtf-info # 1 mostly, 2 for newer Pocket Word documents, space for test like fdo78502.rtf, { for some urtf >5 ubyte !0x7b \b, version %c # The word for character set must precede any text or most other control words >6 string \\mac \b, Apple Macintosh >6 string \\pc # control word \pca >>9 ubyte =0x61 \b, IBM PS/2, code page 850 >>9 ubyte !0x61 \b, IBM PC, code page 437 # unknown character set or ANSI later after control words like # \adeflang1025 \info \title \author \category \manager # "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" #>6 search/105 \\ansi \b, ANSI >6 search/502 \\ansi \b, ANSI >6 default x \b, unknown character set # look for explict codepage keyword # "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" #>5 search/110 \\ansicpg >5 search/500 \\ansicpg # skip unknown or buggy codepage string 0 like in fdo78502.rtf >>&0 ubyte !0x30 \b, code page # codepage string: 437~United States IBM, ..., 1252~WesternEuropean, ..., 57011~Punjabi >>>&-1 string x %-.3s # skip space or \ and display possible 4th digit of code page string >>>&2 ubyte >0x2F >>>>&-1 ubyte <0x3A \b%c # possible 5th digit of code page string >>>>>&0 ubyte >0x2F >>>>>>&-1 ubyte <0x3A \b%c # look again at version byte to use default clause >5 ubyte x # Default language ID for South Asian/Middle Eastern text # language ID: 1025, ..., 1065~Persian, ..., 2057~English_UnitedKingdom, ..., 58380~French_NorthAfrica # Readme-0.72-Persian.rtf #>6 search/1 \\adeflang \b, default middle east language ID >>6 search/497 \\adeflang \b, default middle east language ID # https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a >>>&0 string x %.4s # skip \ and NL and show possible 5th digit of language string >>>&4 ubyte >0x2F >>>>&-1 ubyte <0x3A \b%c # else look for default language to be used when the \plain control word is encountered >>6 default x # "Burow, Steffanie - Im Tal des Schneeleoparden.rtf" #>>>6 search/127 \\deflang >>>6 search/505 \\deflang >>>>&0 string >0 \b, default language ID %-.4s # possible 5th digit of language string >>>>&4 ubyte >0x2F >>>>>&-1 ubyte <0x3A \b%c # Reference: http://latex2rtf.sourceforge.net/rtfspec_63.html # Note: no real world example found 0 string {\\urtf Rich Text Format unicoded data d10 7 a16 19 #!:apple ????RTF !:ext rtf >1 use rtf-info # URL: https://en.wikipedia.org/wiki/Microsoft_Word # Reference: http://fileformats.archiveteam.org/wiki/Microsoft_Word # Note: called by TrID "Pocket Word document" # by PlanMaker "Pocket Word-Handheld PC" for pwd # by PlanMaker "Pocket Word-Pocket PC" for psw 0 string {\\pwd Pocket Word document or template # by SoftMaker Office http://extension.nirsoft.net/pwd #!:mime application/msword # https://reposcope.com/mimetype/application/x-pocket-word !:mime application/x-pocket-word # PWD for Handheld PC variant and PSW for Pocket PC variant # PWT for template !:ext pwd/psw/pwt >0 use rtf-info @ 1.1.1.4 log @2021-03-30 20:21 Christos Zoulas * release 5.40 2021-02-05 16:31 Christos Zoulas * PR/234: Add limit to the number of bytes to scan for encoding * PR/230: Fix /T (trim flag) for regex 2021-02-01 12:31 Christos Zoulas * PR/77: Trim trailing separator. 2020-12-17 15:44 Christos Zoulas * PR/211: Convert system read errors from corrupt ELF files into human readable error messages 2020-12-08 16:24 Christos Zoulas * fix multithreaded decompression file descriptor issue by using close-on-exec (Denys Vlasenko) 2020-06-27 11:58 Christos Zoulas * Exclude surrogate pairs from utf-8 detection (Michael Liu) 2020-06-25 12:53 Christos Zoulas * Include # to the list of ignored format chars (Werner Fink) @ text @d3 1 a3 1 # $File: rtf,v 1.9 2020/12/12 20:01:47 christos Exp $ d36 1 a36 1 # look for explicit codepage keyword @ 1.1.1.5 log @Import file-5.48 (previous was file-5.45) 2026-05-07 11:32 Christos Zoulas * release 5.48 2026-05-11 15:55 Christos Zoulas * add landlock support (valoq) 2026-04-19 15:55 Christos Zoulas * add BE/LE GUID 2026-04-17 11:05 Christos Zoulas * multiple fixes to prevent integer overflow in 32 bits (kerwin) 2026-04-15 12:40 Christos Zoulas * PR/745: streamout: Don't flush when trying to set negative offsets on pipes, just continue, fixes 'cat file.zip | file -' * PR/753: vmihalko: Fix race is magic_getpath() 2026-03-11 15:14 Christos Zoulas * PR/728: Anton Monroe: Reinstate regex/c 2026-02-26 11:32 Christos Zoulas * release 5.47 2026-02-04 09:54 Christos Zoulas * Better multi-compound document identification by following the order of the directories entries. (Thomas Ledoux) 2026-01-19 14:00 Christos Zoulas * if stat fails, don't attempt to restore times (Steven Grubb) 2025-05-28 15:20 Christos Zoulas * PR/622: Odd_Bloke: Handle negative offsets in file_buffer(), when fd is not available. 2025-05-28 12:50 Christos Zoulas * PR/655: jsummers: Obey str_flags in strings like we do for search and regex * PR/659: Pitzl: Apply MAGIC_CONTINUE to annotations; i.e. print only the first, unless -k is specified. 2024-12-19 14:44 Christos Zoulas * PR/592: allow + in format strings * PR/592: signed operations should be done in signed context 2024-12-05 13:50 Christos Zoulas * PR/578: jsummers: Don't crash on cygwin when tm_mon == -1 * PR/579: net147: Fix stack overrun. 2024-11-27 14:44 Christos Zoulas * release 5.46 * Add OFFPOSITIVE 2024-11-25 13:56 Christos Zoulas * avoid leaking symbols in libmagic 2024-11-10 13:56 Christos Zoulas * PR/562: jsummers: Search/regex offsets are absolute to the beginning of the file, so adjust them by subtracting the offset that the "use" starts so that we don't double-count it. 2024-11-09 19:30 Christos Zoulas * PR/543: matshch: bump nbuf so we can get the flags into the buffer. 2024-11-02 14:34 Christos Zoulas * Add Android elf notes (enh) 2023-12-29 12:55 Christos Zoulas * Add limit for number of magic warnings allowed 2023-07-29 12:55 Christos Zoulas * check regex bounds (found by clusterfuzz) @ text @d3 1 a3 1 # $File: rtf,v 1.10 2025/03/21 17:11:56 christos Exp $ a94 5 # https://en.wikipedia.org/wiki/Rich_Text_Format_Directory # https://developer.apple.com/documentation/uniformtypeidentifiers/uttype-swift.struct/rtfd 0 string rtfd\0\0\0\0 Rich Text Format Directory !:ext rtfd @ 1.1.1.1.2.1 log @file rtf was added on branch jym-xensuspend on 2009-05-13 18:51:59 +0000 @ text @d1 15 @ 1.1.1.1.2.2 log @Sync with HEAD. Second commit. See http://mail-index.netbsd.org/source-changes/2009/05/13/msg221222.html @ text @a0 15 #------------------------------------------------------------------------------ # rtf: file(1) magic for Rich Text Format (RTF) # # Duncan P. Simpson, D.P.Simpson@@dcs.warwick.ac.uk # 0 string {\\rtf Rich Text Format data, !:mime text/rtf >5 string 1 version 1, >>6 string \\ansi ANSI >>6 string \\mac Apple Macintosh >>6 string \\pc IBM PC, code page 437 >>6 string \\pca IBM PS/2, code page 850 >>6 default x unknown character set >5 default x unknown version @