Commit 7922da99e27037fa2b01e113e5af171354053ffa
Committed by
Philippe Lagadec
Philippe Lagadec
1 parent
68a910d1
Rtfobj binparser bugfix (#143)
rtfobj: Handling negative bin len (anti-analysis trick)
Showing
1 changed file
with
3 additions
and
0 deletions
oletools/rtfobj.py
| @@ -499,6 +499,9 @@ class RtfParser(object): | @@ -499,6 +499,9 @@ class RtfParser(object): | ||
| 499 | 499 | ||
| 500 | def _bin(self, matchobject, param): | 500 | def _bin(self, matchobject, param): |
| 501 | binlen = int(param) | 501 | binlen = int(param) |
| 502 | + if binlen < 0: | ||
| 503 | + binlen = int(param.strip('-')) | ||
| 504 | + | ||
| 502 | log.debug('\\bin: reading %d bytes of binary data' % binlen) | 505 | log.debug('\\bin: reading %d bytes of binary data' % binlen) |
| 503 | # TODO: handle optional space? | 506 | # TODO: handle optional space? |
| 504 | # TODO: handle negative length, and length greater than data | 507 | # TODO: handle negative length, and length greater than data |