[trampas]

Got a strange problem on my XP. I run LibreOffice and (cutting to the chase) if I create a one-line text document and save it as type DOC, the file created tests as malformed. (using an Office malware testing tool).

If I create a one-line text document in LibreOffice and save it as an RTF, it too looks to be malformed. This is where I could do with some help as I'm not well up on RTF. The file looks bigger than it needs to be (19 lines) and it contains the keyword fnil in the second line. 6 fonts are defined when only one would seem to be necessary.

If I create a similar file with WordPad there are only 4 lines of RTF code and only 1 font is defined.

If anyone reading this happens to have LibreOffice would you mind creating a one line document and saving it as an RTF ? Then view it with Notepad to see what it looks like. Or just advise if the file size is 1KB or 2KB.

Cheers in advance

[Advertisements]

Interesting development. When I create either a small DOC or RTF I can see the time when the file was created. But it typically has a modification time that's 2 seconds later.

I'd say LibreOffice is not the cause of the problem here but it would be useful if someone created a small RTF using LO and posted their findings. How many lines of RTF code, how many font definitions or simply the file size.

[trampas]

Interesting development. When I create either a small DOC or RTF I can see the time when the file was created. But it typically has a modification time that's 2 seconds later.

I'd say LibreOffice is not the cause of the problem here but it would be useful if someone created a small RTF using LO and posted their findings. How many lines of RTF code, how many font definitions or simply the file size.

[trampas]

Just to confirm that there does seem to be a problem with the RTF file, I used a third-party tool to convert the file to a DOC, then tested the DOC with an Office malware test tool. It tested 'vulnerable' as it was malformed.

[trampas]

This thread may now be closed.

LibreOffice does create malformed DOC files and this is normal behaviour. It doesn't write the last 1024 bytes of a standard DOC file to disk. However there's no actual information pertaining to the DOC in those bytes.

And I learned that LibreOffice creates a file and modifies it a few seconds later. Thanks to Process Monitor for that !

The RTF file looks suspicious with all the fonts that it uses (and fnil) but, it seems, that's it.