Rtfobj binparser bugfix (#143)

rtfobj: Handling negative bin len (anti-analysis trick)

Rtfobj binparser bugfix (#143)
rtfobj: Handling negative bin len (anti-analysis trick)
Ahmed Zaki · Philippe Lagadec
1 parent 68a910d1
Showing 1 changed file with 3 additions and 0 deletions
oletools/rtfobj.py
@@ -499,6 +499,9 @@ class RtfParser(object):
  
     def _bin(self, matchobject, param):
         binlen = int(param)
+        if binlen < 0:
+            binlen = int(param.strip('-'))
+            
         log.debug('\\bin: reading %d bytes of binary data' % binlen)
         # TODO: handle optional space?
         # TODO: handle negative length, and length greater than data