Peter M. Groen / oletools

Commit 5d9f21de36644a8c27a5b1360d033faf28824cf3

Authored by kirk-sayre-work
1 parent dc4dffd5

Consume 2 null bytes between name string and tag string if the file being parsed… 

… has a tag or controltiptext.
Inline Side-by-side
Showing 1 changed file with 11 additions and 5 deletions
oletools/oleform.py
  View file @5d9f21d
@@ -273,12 +273,19 @@ def consume_OleSiteConcreteControl(stream): @@ -273,12 +273,19 @@ def consume_OleSiteConcreteControl(stream):
273 control_tip_text_len = consume_CountOfBytesWithCompressionFlag(stream) 273 control_tip_text_len = consume_CountOfBytesWithCompressionFlag(stream)
274 propmask.consume(stream, [('fRuntimeLicKey', 4), ('fControlSource', 4), ('fRowSource', 4)]) 274 propmask.consume(stream, [('fRuntimeLicKey', 4), ('fControlSource', 4), ('fRowSource', 4)])
275 # SiteExtraDataBlock: [MS-OFORMS] 2.2.10.12.4 275 # SiteExtraDataBlock: [MS-OFORMS] 2.2.10.12.4
276 - name = stream.read(name_len) 276 + name = None
  277 + if (name_len > 0):
  278 + name = stream.read(name_len)
277 # Consume 2 null bytes between name and tag. 279 # Consume 2 null bytes between name and tag.
278 - stream.read(2)  
279 - tag = stream.read(tag_len) 280 + if ((tag_len > 0) or (control_tip_text_len > 0)):
  281 + stream.read(2)
  282 + # Sometimes it looks like 2 extra null bytes go here whether or not there is a tag.
  283 + tag = None
  284 + if (tag_len > 0):
  285 + tag = stream.read(tag_len)
280 # Skip SitePosition. 286 # Skip SitePosition.
281 - stream.read(6) 287 + if propmask.fPosition:
  288 + stream.read(8)
282 control_tip_text = stream.read(control_tip_text_len) 289 control_tip_text = stream.read(control_tip_text_len)
283 if (len(control_tip_text) == 0): 290 if (len(control_tip_text) == 0):
284 control_tip_text = None 291 control_tip_text = None
@@ -467,7 +474,6 @@ def consume_ScrollBarControl(stream): @@ -467,7 +474,6 @@ def consume_ScrollBarControl(stream):
467 def extract_OleFormVariables(ole_file, stream_dir): 474 def extract_OleFormVariables(ole_file, stream_dir):
468 control = ExtendedStream.open(ole_file, '/'.join(stream_dir + ['f'])) 475 control = ExtendedStream.open(ole_file, '/'.join(stream_dir + ['f']))
469 variables = list(consume_FormControl(control)) 476 variables = list(consume_FormControl(control))
470 - # print('/'.join(stream_dir + ['o']))  
471 data = ExtendedStream.open(ole_file, '/'.join(stream_dir + ['o'])) 477 data = ExtendedStream.open(ole_file, '/'.join(stream_dir + ['o']))
472 for var in variables: 478 for var in variables:
473 # See FormEmbeddedActiveXControlCached for type definition: [MS-OFORMS] 2.4.5 479 # See FormEmbeddedActiveXControlCached for type definition: [MS-OFORMS] 2.4.5