View Issue Details

IDProjectCategoryView StatusLast Update
0000594filegeneralpublic2017-03-08 13:12
ReporterBoris SABATIER 
Assigned ToChristos Zoulas 
Status assignedResolutionopen 
PlatformOSLinuxOS Version3.16.0
Product Version5.22 
Target VersionFixed in Version 
Summary0000594: Result of magic_file and magic_buffer differ
DescriptionI have a multipart email, identification : RFC822

When i use file command, identification is ok.
When I use libmagic with magic_file(file_path), identification is ok.
When I use libmagic with magic_buffer(buffer), identification is ko => data.

At the end of the email (end of multipart), there is some invalid characters and when I remove them, magic_buffer work.
Steps To ReproduceHere a C program to reproduce the issue:

#include <magic.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define FILE_PATH "TODO"
#define BUFFER_SIZE 1000000
#define BATCH_SIZE 100

int main(int argc, char **argv){
    const char *result_file;
    char buffer[BUFFER_SIZE];
    char* tmpbuf = buffer;
    int fd;
    int rs;
    int buffer_size = 0;
    const char *result_buffer;
    struct magic_set *ms;
    ms = magic_open(MAGIC_NONE);
    if (ms == NULL) {
        printf("ERROR opening MAGIC_NONE: out of memory\n");
        return 10;
    if (magic_load(ms, NULL) == -1) {
        printf("ERROR loading with NULL file: %s\n", magic_error(ms));
        return 11;
    result_file = magic_file(ms, FILE_PATH);
    printf("Result from file : %s \n", result_file);

    fd = open(FILE_PATH, 0);
    while((rs = read(fd, tmpbuf, BATCH_SIZE)) > 0){
        tmpbuf += rs;
        buffer_size += rs;
    result_buffer = magic_buffer(ms, buffer, buffer_size);
    printf("Result from buffer : %s \n", result_buffer);
    return 0;
Result from file : RFC 822 mail, Non-ISO extended-ASCII text, with very long lines, with CRLF line terminators
Result from buffer : data
TagsNo tags attached.



Christos Zoulas

Christos Zoulas

2017-02-25 19:01

manager   ~0001478

Is it possible to supply a data file that reproduces this?


2017-03-08 13:12

reporter   ~0001481

After some test I found the reason for the success of file or magic_file.
The "HOWMANY" compile flag limit the number of byte read.
In my case, the invalid caracters are after this limit.

You can reproduces this with the file attached.

test.eml (117,641 bytes)

Issue History

Date Modified Username Field Change
2017-02-13 17:15 Boris SABATIER New Issue
2017-02-25 18:59 Christos Zoulas Assigned To => Christos Zoulas
2017-02-25 18:59 Christos Zoulas Status new => assigned
2017-02-25 19:01 Christos Zoulas Status assigned => feedback
2017-02-25 19:01 Christos Zoulas Note Added: 0001478
2017-03-08 13:12 Boris SABATIER File Added: test.eml
2017-03-08 13:12 Boris SABATIER Note Added: 0001481
2017-03-08 13:12 Boris SABATIER Status feedback => assigned