stream names should be limited to 32 UTF-16 code points, including the terminating null character
shearer12345 opened this issue · 2 comments
Thanks for js-cfb, and for the changes to truncate stream names introduced in 0e33eb6.
The MS-CFB spec says
storage and stream names are limited to 32 UTF-16 code points, including the terminating null character.
Currently, cfb.js truncates stream name to 32 characters, but as the name has to be null terminated, it should be truncated to 31, allowing WriteShift
to pad the rest with 0
.
So, in cfb.js#894
if(_nm.length > 32) {
console.error("Name " + _nm + " will be truncated to " + _nm.slice(0,32));
_nm = _nm.slice(0, 32);
}
all the 32s should be 31.
In my testing this doesn't break any of my tools, but some throw warnings:
- Python compoundfiles - warns missing NULL terminator in name
- P7Zip - no warnings, displays the character that should be null
- olebrowse - no warnings, doesn't display the character that should be null
- olefile - detects no fatal parsing issue "'incorrect DirEntry name length >64 bytes"
I can submit a PR for this if you'd like
link for MS-CFB docs for reference - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cfb/53989ce4-7b05-4f8d-829b-d08d6148375b
Good catch! When we tested at the time, Excel happily accepted files with 32 UTF-16 characters without a null terminator, but it makes more sense to use the lower limit. Changing 32 -> 31 works. Also make the change in bits/66_dir.js