From 968183592179a1b6e09769d7ad4d566f4a128dad Mon Sep 17 00:00:00 2001
From: Dan Dash <ddash@ciphertechsolutions.com>
Date: Wed, 2 Dec 2020 08:49:39 -0500
Subject: [PATCH] Update package comparison to strip trailing nulls in oleobj.OleObject class names

---
 oletools/rtfobj.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/oletools/rtfobj.py b/oletools/rtfobj.py
index f576745..84becd2 100644
--- a/oletools/rtfobj.py
+++ b/oletools/rtfobj.py
@@ -697,7 +697,7 @@ class RtfObjParser(RtfParser):
                 rtfobj.oledata = obj.data
                 rtfobj.oledata_md5 = hashlib.md5(obj.data).hexdigest()         
                 rtfobj.is_ole = True
-                if obj.class_name.lower() == b'package':
+                if obj.class_name.lower().rstrip(b'\0') == b'package':
                     opkg = oleobj.OleNativeStream(bindata=obj.data,
                                                   package=True)
                     rtfobj.filename = opkg.filename
--
libgit2 0.21.4