3.1.1.4 Run 1

The first run begins on byte 16. The value of the CONTROL field, as described in section 2.1.3.1.1, at that location is 0x03. Represented as bits, the value of the CONTROL field would be %b00000011. The CONTROL field determines a run length, based on the number of '1' and '0' (zero) bits. Run length is equal to the number of '1' bits times 2 plus the number of '0' (zero) bits plus 1 for the CONTROL field itself. With a value of 0x3 for the CONTROL field, the run length is 11 bytes.

 000010: 03 00 0a 00 72 63 70 67 31 32 35

Because the low-order bit in the CONTROL is a 1, the first token in the run is a dictionary reference and consists of the two bytes 00 and 0a. Reading these into a WORD data type ([MS-DTYP]) in big-endian order, the dictionary reference is 0x000a. As described in section 2.1.3.1.5, the offset into the dictionary is the upper 12 bits (for example, 0), and the length is the lower 4 bits (for example, 0xa). The length is stored as 2 less than the actual length, so 2 is added to the length, making the actual length 0x0C (12). Reading 12 bytes from the dictionary at offset zero returns the content "{\rtf1\ansi\".

       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi

This content is copied to the output buffer and written to the write location for the dictionary. The new dictionary is as follows.

 WritePosition: 219
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195: b\i\u\tab\tx{\rtf1\ansi\
  
    Nonprintable characters:
        Position:0168   Byte:0x0d
        Position:0169   Byte:0x0a

The output stream is now as follows.

"{\rtf1\ansi\"

The next control bit is 1 (%b00000011), specifying another dictionary reference for the bytes for which are 00 and 72. Converting to a WORD data type results in 0x0072, and extracting the offset and length results in offset equal to 0x0007, and a length of 0x4 (0x2+2).

Looking up the dictionary position 7 for 4 bytes results in: "ansi".

       0         1         2         3         4         5        6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi

This extracted content is appended to the output buffer and to the dictionary. The new dictionary is as follows.

 WritePosition: 223
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195: b\i\u\tab\tx{\rtf1\ansi\ansi
  
 Nonprintable characters:
  Position:0168 Byte:0x0d
  Position:0169 Byte:0x0a

The output stream is now as follows.

"{\rtf1\ansi\ansi"

The next control bit is 0 (%b00000011), specifying a literal byte token. That token value is 0x63. Because it is a literal, no dictionary lookup happens. The byte is appended to the dictionary and to the output stream.

The new dictionary is as follows.

 WritePosition: 224
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195: b\i\u\tab\tx{\rtf1\ansi\ansic
  
 Nonprintable characters:
  Position:0168 Byte:0x0d
  Position:0169 Byte:0x0a

The output stream is now as follows.

"{\rtf1\ansi\ansic"

The next control bit is 0 (%b00000011), specifying another literal byte token. That token value is 0x70. Because it is a literal, no dictionary lookup happens. The byte is appended to the dictionary and the output stream.

The new dictionary is as follows.

 WritePosition: 225
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195: b\i\u\tab\tx{\rtf1\ansi\ansicp
  
 Nonprintable characters:
  Position:0168 Byte:0x0d
  Position:0169 Byte:0x0a

The output stream is now as follows.

"{\rtf1\ansi\ansicp"

Repeating for the remaining tokens in the run, the following bytes are added to the dictionary and the output stream (67 31 32 35).

The new dictionary is as follows.

 WritePosition: 229
  
       0         1         2         3         4         5         6
       01234567890123456789012345678901234567890123456789012345678901234
 0000: {\rtf1\ansi\mac\deff0\deftab720{\fonttbl;}{\f0\fnil \froman \fswi
 0065: ss \fmodern \fscript \fdecor MS Sans SerifSymbolArialTimes New Ro
 0130: manCourier{\colortbl\red0\green0\blue0__\par \pard\plain\f0\fs20\
 0195: b\i\u\tab\tx{\rtf1\ansi\ansicpg125
  
 Nonprintable characters:
  Position:0168 Byte:0x0d
  Position:0169 Byte:0x0a

The output stream is now as follows.

"{\rtf1\ansi\ansicpg125"

The entire CONTROL field is now processed and the first run is now evaluated.