Details
Description
I've found some PDF files Tika recognizes as application/octet-stream.
These files differs from regularly identified PDF having a different header: the %PDF-N.n string isn't at the beginning (zero offset) of the file but in the first 1024 bytes.
PDF reference states that "The first line of a PDF file shall be a header consisting of the 5 characters %PDF– followed by a version
number of the form 1.N, where N is a digit between 0 and 7" (http://tinyurl.com/8vnzm3c "p. 7.5.2 File Header").
Looking further at implementation notes by Adobe (http://tinyurl.com/cbqpb24 p. 3.4.1 File Header) I've discover that: "Acrobat viewers require only that the header appear somewhere within the first 1024 bytes of the file"
What do you think about a PDF magic match with an offset 0:1024?
<match value="%PDF-" type="string" offset="0:1024"/>
Thank you,
Marco