Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DIFAT integer overflow support to match MS Word's behaviour #124

Open
4 tasks
decalage2 opened this issue Sep 10, 2019 · 0 comments
Open
4 tasks

DIFAT integer overflow support to match MS Word's behaviour #124

decalage2 opened this issue Sep 10, 2019 · 0 comments
Assignees
Milestone

Comments

@decalage2
Copy link
Owner

According to this article, some malicious files use a trick that works with Word but might trigger errors in other parsers such as olefile:
https://www.mimecast.com/blog/2019/03/the-return-of-the-equation-editor-exploit--difat-overflow
Same on web archive: http://web.archive.org/web/20190307091006/https://www.mimecast.com/blog/2019/03/the-return-of-the-equation-editor-exploit--difat-overflow/

When computing the offset of a sector from a large index in the DIFAT, in some cases an integer overflow may happen because the offset may be larger than 32 bits. In that case, it looks like MS Word or Windows truncates the offset at 32 bits, resulting in a smaller offset.

TODO:

  • Prepare sample files triggering the integer overflow, test them with MS Word, Excel, etc
  • Check what is the olefile behaviour in that case
  • Change olefile to match Word's behaviour
  • Provide a way for olefile callers to be informed when such an integer overflow happens (should be an alert that the file is suspicious)
@decalage2 decalage2 added this to the olefile 0.47 milestone Sep 10, 2019
@decalage2 decalage2 self-assigned this Sep 10, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant