Incorrect VBA dir stream parsing of REFERENCENAME

Open bnbdr opened this issue 5 years ago • 1 comments

When encountering a REFERENCENAME record of the VbaProject dir stream where reference_reserved is not 0x003E the code doesn't continue parsing from that point because the implementation used a switch-case, so the new value is overrun in the new iteration of the loop. https://github.com/Velocidex/oleparse/blob/34195d4131963a0d1e8d61c9773fb75674fec7c0/oleparse.go#L681

Using multiple if statements would solve this, similar to how olevba has done this

Dec 22 '20 09:12 bnbdr

Hi @bnbdr just looking at this repo now! Thank you for pointing this out. Do you by any chance have a sample that is impacted by this issue?

Jun 17 '22 04:06 mgreen27