Merge pull request #648 from ddash-ct/507-rtfpackage

Strip trailing nulls for package check

Merge pull request #648 from ddash-ct/507-rtfpackage
Strip trailing nulls for package check
Philippe Lagadec · GitHub
2 parents 2f764df7 96818359
Showing 1 changed file with 1 additions and 1 deletions
oletools/rtfobj.py
@@ -697,7 +697,7 @@ class RtfObjParser(RtfParser):
                 rtfobj.oledata = obj.data
                 rtfobj.oledata_md5 = hashlib.md5(obj.data).hexdigest()         
                 rtfobj.is_ole = True
-                if obj.class_name.lower() == b'package':
+                if obj.class_name.lower().rstrip(b'\0') == b'package':
                     opkg = oleobj.OleNativeStream(bindata=obj.data,
                                                   package=True)
                     rtfobj.filename = opkg.filename