Zlib header not detected by offzip

up vote
1
down vote

favorite

I'm looking into a file that contains some zlib compressed chunks, some are detected by Offzip as valid, one is not:

0x 78 01 F3 48 --valid and has a matching adler32 hash

0x 78 01 03 00 --invalid

0x 78 01 63 64 --valid not sure about the hash

I think it's only the first three bytes that indicate the compression method and flags, so I'm unsure as to why the second entry is not detected. It certainly looks like a zlib data block, but I'm a bit lost

Any input or advice would be greatly appreciated

edited Nov 19 at 19:32

asked Nov 19 at 18:20

Tony

1,44552849

add a comment |

up vote
1
down vote

favorite

I'm looking into a file that contains some zlib compressed chunks, some are detected by Offzip as valid, one is not:

0x 78 01 F3 48 --valid and has a matching adler32 hash

0x 78 01 03 00 --invalid

0x 78 01 63 64 --valid not sure about the hash

Any input or advice would be greatly appreciated

edited Nov 19 at 19:32

asked Nov 19 at 18:20

Tony

1,44552849

add a comment |

up vote
1
down vote

favorite

I'm looking into a file that contains some zlib compressed chunks, some are detected by Offzip as valid, one is not:

0x 78 01 F3 48 --valid and has a matching adler32 hash

0x 78 01 03 00 --invalid

0x 78 01 63 64 --valid not sure about the hash

Any input or advice would be greatly appreciated

edited Nov 19 at 19:32

asked Nov 19 at 18:20

Tony

1,44552849

I'm looking into a file that contains some zlib compressed chunks, some are detected by Offzip as valid, one is not:

0x 78 01 F3 48 --valid and has a matching adler32 hash

0x 78 01 03 00 --invalid

0x 78 01 63 64 --valid not sure about the hash

Any input or advice would be greatly appreciated

c# compression zlib dotnetzip

edited Nov 19 at 19:32

asked Nov 19 at 18:20

Tony

1,44552849

edited Nov 19 at 19:32

asked Nov 19 at 18:20

Tony

1,44552849

edited Nov 19 at 19:32

asked Nov 19 at 18:20

Tony

1,44552849

asked Nov 19 at 18:20

Tony

1,44552849

asked Nov 19 at 18:20

Tony

1,44552849

add a comment |

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

Those are all valid starts to zlib streams. Of course, none of them are valid entire zlib streams, since the minimum zlib stream length is eight bytes.

The 78 01 03 00 has a valid zlib header, 78 01, and a valid and in fact complete deflate stream, 03 00. That is an empty fixed codes deflate block marked as the last block. If you follow that with 00 00 00 01 (the Adler-32 check value for zero bytes), then you have a complete and correct zlib stream.

answered Nov 20 at 2:15

Mark Adler

56.9k760107

Thanks for the info Mark. I am indeed seeing an empty and complete zlib stream. Is there a common use for empty streams like this? For use as a marker of some kind?
– Tony
Nov 20 at 7:54

1

I have no idea how common empty zlib streams are. However the tool clearly has a bug if it is marking that as not the start of a valid zlib stream.
– Mark Adler
Nov 20 at 15:33

Thanks Mark. Appreciate the information.
– Tony
Nov 21 at 13:30

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53380536%2fzlib-header-not-detected-by-offzip%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
2
down vote

accepted

Those are all valid starts to zlib streams. Of course, none of them are valid entire zlib streams, since the minimum zlib stream length is eight bytes.

answered Nov 20 at 2:15

Mark Adler

56.9k760107

Thanks for the info Mark. I am indeed seeing an empty and complete zlib stream. Is there a common use for empty streams like this? For use as a marker of some kind?
– Tony
Nov 20 at 7:54

1

I have no idea how common empty zlib streams are. However the tool clearly has a bug if it is marking that as not the start of a valid zlib stream.
– Mark Adler
Nov 20 at 15:33

Thanks Mark. Appreciate the information.
– Tony
Nov 21 at 13:30

add a comment |

up vote
2
down vote

accepted

Those are all valid starts to zlib streams. Of course, none of them are valid entire zlib streams, since the minimum zlib stream length is eight bytes.

answered Nov 20 at 2:15

Mark Adler

56.9k760107

Thanks for the info Mark. I am indeed seeing an empty and complete zlib stream. Is there a common use for empty streams like this? For use as a marker of some kind?
– Tony
Nov 20 at 7:54

1

I have no idea how common empty zlib streams are. However the tool clearly has a bug if it is marking that as not the start of a valid zlib stream.
– Mark Adler
Nov 20 at 15:33

Thanks Mark. Appreciate the information.
– Tony
Nov 21 at 13:30

add a comment |

up vote
2
down vote

accepted

Those are all valid starts to zlib streams. Of course, none of them are valid entire zlib streams, since the minimum zlib stream length is eight bytes.

answered Nov 20 at 2:15

Mark Adler

56.9k760107

Those are all valid starts to zlib streams. Of course, none of them are valid entire zlib streams, since the minimum zlib stream length is eight bytes.

answered Nov 20 at 2:15

Mark Adler

56.9k760107

answered Nov 20 at 2:15

Mark Adler

56.9k760107

answered Nov 20 at 2:15

Mark Adler

56.9k760107

answered Nov 20 at 2:15

Mark Adler

56.9k760107

Thanks for the info Mark. I am indeed seeing an empty and complete zlib stream. Is there a common use for empty streams like this? For use as a marker of some kind?
– Tony
Nov 20 at 7:54

1

I have no idea how common empty zlib streams are. However the tool clearly has a bug if it is marking that as not the start of a valid zlib stream.
– Mark Adler
Nov 20 at 15:33

Thanks Mark. Appreciate the information.
– Tony
Nov 21 at 13:30

add a comment |

Thanks for the info Mark. I am indeed seeing an empty and complete zlib stream. Is there a common use for empty streams like this? For use as a marker of some kind?
– Tony
Nov 20 at 7:54

1

I have no idea how common empty zlib streams are. However the tool clearly has a bug if it is marking that as not the start of a valid zlib stream.
– Mark Adler
Nov 20 at 15:33

Thanks Mark. Appreciate the information.
– Tony
Nov 21 at 13:30

Thanks for the info Mark. I am indeed seeing an empty and complete zlib stream. Is there a common use for empty streams like this? For use as a marker of some kind?
– Tony
Nov 20 at 7:54

I have no idea how common empty zlib streams are. However the tool clearly has a bug if it is marking that as not the start of a valid zlib stream.
– Mark Adler
Nov 20 at 15:33

Thanks Mark. Appreciate the information.
– Tony
Nov 21 at 13:30

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

Some of your past answers have not been well-received, and you're in danger of being blocked from answering.

Please pay close attention to the following guidance:

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Nsryjdtyk