Peter M. Groen / oletools

Commit 29b08127e8c34998bad01001b3b1056049b9d7a4

Authored by decalage2
1 parent 1fa960ff

olevba: PR #135 fixing issue #132 for some Mac files

Inline Side-by-side
Showing 1 changed file with 6 additions and 2 deletions
oletools/olevba.py
  View file @29b0812
@@ -193,8 +193,9 @@ from __future__ import print_function @@ -193,8 +193,9 @@ from __future__ import print_function
193 # 2017-03-08 PL: - fixed absolute imports 193 # 2017-03-08 PL: - fixed absolute imports
194 # 2017-03-16 PL: - fixed issues #148 and #149 for option --reveal 194 # 2017-03-16 PL: - fixed issues #148 and #149 for option --reveal
195 # 2017-05-19 PL: - added enable_logging to fix issue #154 195 # 2017-05-19 PL: - added enable_logging to fix issue #154
  196 +# 2017-05-31 c1fe: - PR #135 fixing issue #132 for some Mac files
196 197
197 -__version__ = '0.51dev8' 198 +__version__ = '0.51dev9'
198 199
199 #------------------------------------------------------------------------------ 200 #------------------------------------------------------------------------------
200 # TODO: 201 # TODO:
@@ -1456,7 +1457,10 @@ def _extract_vba(ole, vba_root, project_path, dir_path, relaxed=False): @@ -1456,7 +1457,10 @@ def _extract_vba(ole, vba_root, project_path, dir_path, relaxed=False):
1456 reference_sizeof_name = struct.unpack("<L", dir_stream.read(4))[0] 1457 reference_sizeof_name = struct.unpack("<L", dir_stream.read(4))[0]
1457 reference_name = dir_stream.read(reference_sizeof_name) 1458 reference_name = dir_stream.read(reference_sizeof_name)
1458 reference_reserved = struct.unpack("<H", dir_stream.read(2))[0] 1459 reference_reserved = struct.unpack("<H", dir_stream.read(2))[0]
1459 - 1460 + # According to [MS-OVBA] 2.3.4.2.2.2 REFERENCENAME Record:
  1461 + # "Reserved (2 bytes): MUST be 0x003E. MUST be ignored."
  1462 + # So let's ignore it, otherwise it crashes on some files (issue #132)
  1463 + # PR #135 by @c1fe:
1460 # contrary to the specification I think that the unicode name 1464 # contrary to the specification I think that the unicode name
1461 # is optional. if reference_reserved is not 0x003E I think it 1465 # is optional. if reference_reserved is not 0x003E I think it
1462 # is actually the start of another REFERENCE record 1466 # is actually the start of another REFERENCE record