olefile icon indicating copy to clipboard operation
olefile copied to clipboard

Break when property offset exceeds stream

Open matthieuxyz opened this issue 4 years ago • 0 comments

When a file is corrupted or from untrusted source (possibly a malware), the number of property can be extremely large and exceed the longer of the stream.

Instead of looping over and over for unparsable properties, we should exit the loop early.

Sample that cause the issue: https://www.virustotal.com/gui/file/250ff87ba85b2cb7bd04c9e4442eb08f70d5c1d555347c16addaa0d05bda8cb0/detection https://app.any.run/tasks/f9e1d49a-5eec-4392-97b3-a109a2db8007/

matthieuxyz avatar Mar 12 '20 13:03 matthieuxyz