Peter M. Groen / oletools

Commit 5d9f21de36644a8c27a5b1360d033faf28824cf3

Authored by kirk-sayre-work
1 parent dc4dffd5

Consume 2 null bytes between name string and tag string if the file being parsed… 

… has a tag or controltiptext.
Inline Side-by-side
Showing 1 changed file with 11 additions and 5 deletions
oletools/oleform.py
  View file @5d9f21d
... ... @@ -273,12 +273,19 @@ def consume_OleSiteConcreteControl(stream):
273 273 control_tip_text_len = consume_CountOfBytesWithCompressionFlag(stream)
274 274 propmask.consume(stream, [('fRuntimeLicKey', 4), ('fControlSource', 4), ('fRowSource', 4)])
275 275 # SiteExtraDataBlock: [MS-OFORMS] 2.2.10.12.4
276   - name = stream.read(name_len)
  276 + name = None
  277 + if (name_len > 0):
  278 + name = stream.read(name_len)
277 279 # Consume 2 null bytes between name and tag.
278   - stream.read(2)
279   - tag = stream.read(tag_len)
  280 + if ((tag_len > 0) or (control_tip_text_len > 0)):
  281 + stream.read(2)
  282 + # Sometimes it looks like 2 extra null bytes go here whether or not there is a tag.
  283 + tag = None
  284 + if (tag_len > 0):
  285 + tag = stream.read(tag_len)
280 286 # Skip SitePosition.
281   - stream.read(6)
  287 + if propmask.fPosition:
  288 + stream.read(8)
282 289 control_tip_text = stream.read(control_tip_text_len)
283 290 if (len(control_tip_text) == 0):
284 291 control_tip_text = None
... ... @@ -467,7 +474,6 @@ def consume_ScrollBarControl(stream):
467 474 def extract_OleFormVariables(ole_file, stream_dir):
468 475 control = ExtendedStream.open(ole_file, '/'.join(stream_dir + ['f']))
469 476 variables = list(consume_FormControl(control))
470   - # print('/'.join(stream_dir + ['o']))
471 477 data = ExtendedStream.open(ole_file, '/'.join(stream_dir + ['o']))
472 478 for var in variables:
473 479 # See FormEmbeddedActiveXControlCached for type definition: [MS-OFORMS] 2.4.5
... ...