[File] [PATCH] of Magdir/fonts for GEM GDOS font (*.fnt *.gft)

Christoph Biedl astron.com.bwoj at manchmal.in-ulm.de
Sat Jul 6 12:19:27 UTC 2019


Jörg Jenderek wrote...

> Some examples like ROYALK30.GFT have null values for mask fields.
> This is expressed bv line
>  62	ulelong		0
> Unfortunately this is not unique enough, but this is not a problem
> because identifying and showing parts are separated.

Even with your additional rules, below, this is *way* to broad.

My personal rule to avoid mis-detections in libmagic is: A magic pattern
must probe at least 33 Bits of identifying information before printing
anything which is the point of no return by design. Comparisons to one
or more bytes of value zero are not taken into account, since that is
too common.

So the very traditional 32 bits identifying magic are not enough, for a
reason.

If my calculations are correct, this particular rule set allows, thus
provides identifying bits:

    0 Bits from above

> So i add addition
> al
> test lines for such examples. So skip ISO 9660 CD-ROM images with many
> nulls by looking for low positive font size by line.
>  >2	uleshort	>2

65533 of 2^16 values
    0.00 Bits

> Highest size for fonts was 48. So check also for upper limit by line
>  >>2	uleshort	<49

49 of 2^8 values
    2.3 Bits

> So skip misidentified DOS 2.0 backup id file like BACKUPID.@@@.
> At this stage some files like MS Windows icons like "download.ico" are
> still misidentified. So i also test for valid font name by additional
> line
>  >>>4	ubeshort	>0x1F00

57600 of 2^16
    0.19 Bits

Sum: ~2.5 Bits

As a result, I get a lot of mis-detections. Please refine that ruleset.

For the time being I'll disable it in Debian to limit the damage.

    Christoph


More information about the File mailing list