[Bug 60279] New: VBAMacroReader throws IllegalArgumentException on some files

classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

[Bug 60279] New: VBAMacroReader throws IllegalArgumentException on some files

Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=60279

            Bug ID: 60279
           Summary: VBAMacroReader throws IllegalArgumentException on some
                    files
           Product: POI
           Version: unspecified
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: normal
          Priority: P2
         Component: POIFS
          Assignee: [hidden email]
          Reporter: [hidden email]

Created attachment 34391
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=34391&action=edit
One triggering file from common crawl

On a few files in our regression corpus, I got:

java.lang.IllegalArgumentException: Header byte 0x01 expected, received 0x00
    at
org.apache.poi.util.RLEDecompressingInputStream.<init>(RLEDecompressingInputStream.java:79)
...

I'm not sure if these files have valid macros in them or another embedded
object.  Let's investigate.

--
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 60279] VBAMacroReader throws IllegalArgumentException on some files

Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=60279

--- Comment #1 from veena subbu <[hidden email]> ---
Am also facing th same problem.'Could anyone resolve it for us.

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 60279] VBAMacroReader throws IllegalArgumentException on some files

Bugzilla from bugzilla@apache.org
In reply to this post by Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=60279

--- Comment #2 from Javen O'Neal <[hidden email]> ---
Sounds like we have a volunteer! Veena, are you interested in researching this
problem and putting together a patch?

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 60279] VBAMacroReader throws IllegalArgumentException on some files

Bugzilla from bugzilla@apache.org
In reply to this post by Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=60279

--- Comment #3 from Tim Allison <[hidden email]> ---
On the attached file, I don't have a solution, but I wanted to document what
I've found so far.

1) This file's macros cause Microsoft to complain on document load (when you
enable macros).  So, something is wonky at least for this document.

2) decelage's oledump.py is able to read this macro as:
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



oledump.py commandline: oledump.py -s 7 -v file.doc

2) The module offset is read as 5541 (15A5), but the actual record starts at
02F9.

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 60279] VBAMacroReader throws IllegalArgumentException on some files

Bugzilla from bugzilla@apache.org
In reply to this post by Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=60279

--- Comment #4 from Tim Allison <[hidden email]> ---
Veena, are you able to share your file?

I think the offset is corrupt in my file, and I'm guessing that decalage's tool
may be brute-force reading the macros out of the ModuleStream.

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 60279] VBAMacroReader throws IllegalArgumentException on some files

Bugzilla from bugzilla@apache.org
In reply to this post by Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=60279

--- Comment #5 from Tim Allison <[hidden email]> ---
Total <face_palm/>

oledump.py is by Didier Stevens

Ugh...Sorry.

I filled out quite a bit in the vba stream parser hoping that an incorrect
parse was leading to an incorrect offset.  The good news: we can now get quite
a bit more metadata about the macros out, and there were some records that do
require special handling.  The bad news: the offset really was incorrect and no
improvements to the parser fixed this.


So, I have a patch for this that backs off to brute force to find the macro
contents if there's an RLE decompression failure.

I'll wait to apply it until we release 3.17.

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

[Bug 60279] VBAMacroReader throws IllegalArgumentException on some files

Bugzilla from bugzilla@apache.org
In reply to this post by Bugzilla from bugzilla@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=60279

Tim Allison <[hidden email]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #6 from Tim Allison <[hidden email]> ---
r1808301

--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]