Skip to content

Search and strip byte-array headers

Locate a byte or text pattern within a byte array and optionally strip bytes preceding it, for example removing junk bytes before a PDF file header. This operation is triggered when a consumer calls ByteExtensions.Search or .StripHeader on a byte[].

Field Value
Operation ID OP-09
Trigger A consumer calls ByteExtensions.Search or .StripHeader on a byte[].
Inputs bytes (byte[]), searchFor (string or byte[]), optional start (int, default 0), maxBytesToSearch (int)
Outputs Search returns the match position or -1; StripHeader returns a (possibly trimmed) byte[] and an out bool found.
Primary components ByteExtensions.Search, .StripHeader, .GetMD5Hash
Entry point src/SAIF.NetCore.Common/SAIF.NetCore.Common/SAIF.NetCore.Common/Extensions/ByteExtensions.cs

Steps

  1. Search: perform a linear search for searchFor starting at start; when maxBytesToSearch > 0, it is treated as a positive absolute inclusive candidate-start limit — the search still examines the candidate position exactly at maxBytesToSearch, it just stops considering any later start position. A non-positive maxBytesToSearch disables the limit entirely. The string overload encodes the search text as ASCII.
  2. Return the match position, or -1 if not found.
  3. StripHeader(bytes, searchFor, out found, max=100): call Search for the header text, forwarding the same maxBytesToSearch candidate-start limit.
  4. If the match position is greater than 0, return the bytes from that position onward and set found = true. (BR-021)
  5. If the position is 0 (header already at the start) or -1 (not found): return the original array unchanged and set found = false.
  6. GetMD5Hash: compute and return the raw 16-byte MD5 digest of the byte array (byte[], not a hex string). Callers that need a hex-encoded representation must format the bytes themselves.
  7. MD5 is cryptographically broken; acceptable for checksums only, not for security purposes*.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Call StripHeader]) --> Search[Search for header text]
    Search --> PosCheck{position > 0?}
    PosCheck -->|Yes| Strip["Return bytes from position<br>onward, found = true"]
    PosCheck -->|No| Unchanged["Return original array,<br>found = false"]
    Strip --> End([Return result])
    Unchanged --> End

Failure and edge-case behavior

  • Header located at position 0: treated the same as not-found (found = false), per BR-021.
  • GetMD5Hash is suitable only for checksums, never for security-sensitive integrity checks*.
  • maxBytesToSearch is an absolute inclusive candidate-start index, not a count of bytes relative to start; the matched header's remaining bytes can extend beyond it since only the starting candidate position is bounded.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • src/SAIF.NetCore.Common/SAIF.NetCore.Common/SAIF.NetCore.Common/Extensions/ByteExtensions.cs