blah

Cisco-Talos · Aug 2, 2024 · a963c3c · a963c3c
1 parent 2b30307
commit a963c3c
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 2 deletions.
diff --git a/libclamav/ole2_extract.c b/libclamav/ole2_extract.c
@@ -641,7 +641,6 @@ static int ole2_cmp_name(const char *const name, uint32_t name_size, const char
         decoded[j] = ((unsigned char)name[i + 1]) << 4;
         decoded[j] += name[i];
     }
-    //fprintf(stderr, "%s::%d::%s\n", __FUNCTION__, __LINE__, decoded);
 
     return strcasecmp(decoded, keyword);
 }
@@ -995,6 +994,20 @@ static int ole2_walk_property_tree(ole2_header_t *hdr, const char *dir, int32_t
                 memcpy(&(pImageDirectory->word_block), &(prop_block[idx]), sizeof((pImageDirectory->word_block)));
                 pImageDirectory->bFibRgFcLcb97Header_initialized = getFibRgFcLcb97Header(&(prop_block[idx]), hdr, &(pImageDirectory->fibRgFcLcb97Header));
             }
+
+#if 0
+            {
+                size_t i;
+                here;
+    fprintf(stderr, "%s::%d::", __FUNCTION__, __LINE__ );
+    for (i = sizeof(property_t); i < 1024; i++){
+        fprintf(stderr, "%02x ", name[i]);
+    }
+    fprintf(stderr, "\n");
+            }
+#endif
+
+
         } else if (0 == ole2_cmp_name(prop_block[idx].name, prop_block[idx].name_size, "WorkBook")) {
             test_for_xls_encryption(&(prop_block[idx]), hdr, pEncryptionStatus);
         } else if (0 == ole2_cmp_name(prop_block[idx].name, prop_block[idx].name_size, "PowerPoint Document")) {

diff --git a/libclamav/ole2_extract_images.h b/libclamav/ole2_extract_images.h
@@ -985,7 +985,10 @@ void ole2_process_image_directory( cli_ctx * ctx, ole2_header_t * hdr, ole2_imag
         size_t offset = get_stream_data_offset(hdr, tableStream, tableStream->start_block);
         /*TODO: Fix hardcoded 4k*/
         ptr = fmap_need_off_once(hdr->map, offset, 4096);
-fprintf(stderr, "%s::%d::Fix hardcoded 4k\n", __FUNCTION__, __LINE__);
+fprintf(stderr, "\n%s::%d::tableStream->size = %d (0x%x)\n", __FUNCTION__, __LINE__, tableStream->size, tableStream->size);
+fprintf(stderr, "%s::%d::tableStream->type = %d (0x%x)\n", __FUNCTION__, __LINE__, tableStream->type, tableStream->type);
+fprintf(stderr, "%s::%d::tableStream->next = %d (0x%x)\n", __FUNCTION__, __LINE__, tableStream->next, tableStream->next);
+fprintf(stderr, "%s::%d::Fix hardcoded 4k, probably with tableStream->size\n", __FUNCTION__, __LINE__);
         if (NULL == ptr) {
             cli_dbgmsg("ERROR: Invalid offset for File Information Block %ld (0x%lx)\n", offset, offset);
             goto done;