"Paul A. Rombouts" <[EMAIL PROTECTED]> writes:

> "Andrew M. Bishop" wrote:
> > 
> > "Paul A. Rombouts" <[EMAIL PROTECTED]> writes:
> > 
> > > "Andrew M. Bishop" wrote:
> > > >
> > > > "Paul A. Rombouts" <[EMAIL PROTECTED]> writes:
> > > >
> > > > > I've had a problem with the website abcnews.go.com that also turned to be
> > > > > deflate-compression related.
> > > > > When I use Mozilla the site displays OK, but the Internet Explorer users on 
>my
> > > > > LAN got a blank page.
> ... 
> > > > What does Internet Explorer ask for and what does the site send if

...

> > > Here's a hex dump of the first 64 bytes of the content:
> > >
> > > 0001151 33 32 36 43 0d 0a ed 7d 7b 57 e2 c8 16 ef df ed
> > > 0001171 5a fd 1d aa 33 6b 14 8f f2 56 7c 62 2f 04 54 66
> > > 0001211 14 3c 80 ed f4 9c 7b 16 2b 40 80 4c 07 c2 24 41
> > > 0001231 db 99 d3 1f e8 7e cb fb db 55 95 a4 02 41 d1 ee
> > >
> > I am very interested to see that the first six characters of the reply
> > data look like a DOS format line, terminated with CR, LF.
> > 
> > 326C^M^J
> > 
> > I don't know if it means anything or is just coincidence.
> 
> Yes, I noticed that too. I also noticed that that the reply header contains
> "Transfer-Encoding: chunked".

I noticed that also, but somehow the significance of it didn't strike me.

> So the first byte of the compressed data is actually 0xed.
> I fetched several different pages from abcnews.go.com with 
> "wget --user-agent='Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; T312461)'
>  --header='Accept-Encoding: gzip, deflate' [URL]..."
> and the first two bytes were always 0xed, 0x7d.

When problems were seen before with www.redbox.cz the first few bytes
that it sent were

ec 5d 5d 6f

which are not the same although the first byte is only different by 1.

> Hmmm..., that's very odd. That's the way I read it too.
> I can only conclude that Microsoft-IIS is non-compliant with the RFCs.
> Perhaps Microsoft has "embraced and extended" the ZLIB Compressed Data Format?

We do know that Microsoft uses zlib due to its announcement after the
zlib double free problem was found earlier in the year.  I don't know
if it uses it for deflate though.

-- 
Andrew.
----------------------------------------------------------------------
Andrew M. Bishop                             [EMAIL PROTECTED]
                                      http://www.gedanken.demon.co.uk/

WWWOFFLE users page:
        http://www.gedanken.demon.co.uk/wwwoffle/version-2.7/user.html

Reply via email to