Peter M. Groen / oletools

Commit 80bf761ae3ca0050e8951c15eb6030b535b4df24

Authored by decalage2
1 parent 6fcf5ada

rtfobj: ignore optional space after \bin (issue #185)

Inline Side-by-side
Showing 1 changed file with 7 additions and 2 deletions
oletools/rtfobj.py
  View file @80bf761
... ... @@ -75,6 +75,7 @@ http://www.decalage.info/python/oletools
75 75 # 2017-06-29 PL: - temporary fix for issue #178
76 76 # 2017-07-14 v0.51.1 PL: - disabled logging of each control word (issue #184)
77 77 # 2017-07-24 PL: - fixed call to RtfParser._end_of_file (issue #185)
  78 +# - ignore optional space after \bin (issue #185)
78 79  
79 80 __version__ = '0.51.1dev3'
80 81  
... ... @@ -509,15 +510,19 @@ class RtfParser(object):
509 510  
510 511 def _bin(self, matchobject, param):
511 512 binlen = int(param)
  513 + # handle negative length
512 514 if binlen < 0:
513 515 log.warn('Detected anti-analysis trick: \\bin object with negative length at index %X' % self.index)
514 516 # binlen = int(param.strip('-'))
515 517 # According to my tests, if the bin length is negative,
516 518 # it should be treated as a null length:
517 519 binlen=0
  520 + # ignore optional space after \bin
  521 + if self.data[self.index] == ' ':
  522 + log.debug('\\bin: ignoring whitespace before data')
  523 + self.index += 1
518 524 log.debug('\\bin: reading %d bytes of binary data' % binlen)
519   - # TODO: handle optional space?
520   - # TODO: handle negative length, and length greater than data
  525 + # TODO: handle length greater than data
521 526 bindata = self.data[self.index:self.index + binlen]
522 527 self.index += binlen
523 528 self.bin(bindata)
... ...