Fix file header detection in open_decompress (#998)

dissect/target/helpers/fsutil.py

@@ -512,10 +512,12 @@ def open_decompress(
         An binary or text IO stream, depending on the mode with which the file was opened.
 
     Example:
-        bytes_buf = open_decompress(Path("/dir/file.gz")).read()
+        .. code-block:: python
 
-        for line in open_decompress(Path("/dir/file.gz"), "rt"):
-            print(line)
+            bytes_buf = open_decompress(Path("/dir/file.gz")).read()
+
+            for line in open_decompress(Path("/dir/file.gz"), "rt"):
+                print(line)
     """
     if path and fileobj:
         raise ValueError("path and fileobj are mutually exclusive")
@@ -527,6 +529,7 @@ def open_decompress(
         file = path.open("rb")
     else:
         file = fileobj
+        file.seek(0)
 
     magic = file.read(5)
     file.seek(0)

tests/helpers/test_fsutil.py

@@ -646,8 +646,11 @@ def test_pure_dissect_path__from_parts_no_fs_exception() -> None:
 )
 def test_open_decompress(file_name: str, compressor: Callable, content: bytes) -> None:
     vfs = VirtualFilesystem()
-    vfs.map_file_fh(file_name, io.BytesIO(compressor(content)))
+    fh = io.BytesIO(compressor(content))
+    vfs.map_file_fh(file_name, fh)
     assert fsutil.open_decompress(vfs.path(file_name)).read() == content
+    fh.seek(2)
+    assert fsutil.open_decompress(fileobj=fh).read() == content
 
 
 def test_open_decompress_text_modes() -> None: