search

decalage2 / oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
http://www.decalage.info/python/oletools
Other
2.89k stars 565 forks source link

olevba: Add zipfile content read limit #788

Open dlucredativ opened 1 year ago

dlucredativ commented 1 year ago

Even small input files can lead to memory exhaustion inside oletools.olevba.VBA_Parser.open_openxml, as zipped contents are read into memory (https://github.com/decalage2/oletools/blob/master/oletools/olevba.py#L2876-L2879).

As a safety-measure one could implement a configurable limit for those reads.