From 332a4a5b3fc9f1a4e98928222a10a9f09ae4a017 Mon Sep 17 00:00:00 2001
From: Christian Herdtweck <christian.herdtweck@intra2net.com>
Date: Tue, 23 Oct 2018 10:51:14 +0200
Subject: [PATCH] oleid: detect encryption for ppt files

---
 oletools/oleid.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/oletools/oleid.py b/oletools/oleid.py
index d4e9d9a..fcfcfa7 100644
--- a/oletools/oleid.py
+++ b/oletools/oleid.py
@@ -244,7 +244,7 @@ class OleID(object):
         if not self.ole:
             return suminfo, appname
         self.suminfo_data = {}
-        # check stream SummaryInformation
+        # check stream SummaryInformation (not present e.g. in encrypted ppt)
         if self.ole.exists("\x05SummaryInformation"):
             suminfo.value = True
             self.suminfo_data = self.ole.getproperties("\x05SummaryInformation")
@@ -284,6 +284,10 @@ class OleID(object):
         # check if this is an OpenXML encrypted file
         elif self.ole.exists('EncryptionInfo'):
             encrypted.value = True
+        # or an encrypted ppt file
+        if self.ole.exists('EncryptedSummary') and \
+                not self.ole.exists('SummaryInformation'):
+            encrypted.value = True
         return encrypted
 
     def check_word(self):
--
libgit2 0.21.4