From d6832ffbf5a214d54d0e976e40fa47489ccd1104 Mon Sep 17 00:00:00 2001
From: J <47265397+UserJHansen@users.noreply.github.com>
Date: Wed, 22 May 2024 19:15:37 +1000
Subject: [PATCH 1/2] Fix for incorrect key size with 0 length keySize var

I have found several pptx samples which don't have a proper keySize set.

Since 0 is an incorrect key size this change increases the chance that the file will still be readable.
---
 msoffcrypto/format/common.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/msoffcrypto/format/common.py b/msoffcrypto/format/common.py
index 1821229..8f401be 100644
--- a/msoffcrypto/format/common.py
+++ b/msoffcrypto/format/common.py
@@ -13,6 +13,7 @@ def _parse_encryptionheader(blob):
     (algId,) = unpack("<I", blob.read(4))
     (algIdHash,) = unpack("<I", blob.read(4))
     (keySize,) = unpack("<I", blob.read(4))
+    keySize = 40 if keySize == 0 else keySize
     (providerType,) = unpack("<I", blob.read(4))
     (reserved1,) = unpack("<I", blob.read(4))
     (reserved2,) = unpack("<I", blob.read(4))

From f14461245e09f49b6338dd8c42037bbeaa4b76d4 Mon Sep 17 00:00:00 2001
From: nolze <nolze@int3.net>
Date: Fri, 24 May 2024 02:07:18 +0900
Subject: [PATCH 2/2] Update based on the spec (RC4 CryptoAPI Encryption
 Header)

---
 msoffcrypto/format/common.py | 24 +++++++++++++++++++++++-
 msoffcrypto/format/doc97.py  | 21 +--------------------
 msoffcrypto/format/ppt97.py  | 21 +--------------------
 msoffcrypto/format/xls97.py  | 21 +--------------------
 4 files changed, 26 insertions(+), 61 deletions(-)

diff --git a/msoffcrypto/format/common.py b/msoffcrypto/format/common.py
index 8f401be..b5c6060 100644
--- a/msoffcrypto/format/common.py
+++ b/msoffcrypto/format/common.py
@@ -1,3 +1,4 @@
+import io
 import logging
 from struct import unpack
 
@@ -13,7 +14,6 @@ def _parse_encryptionheader(blob):
     (algId,) = unpack("<I", blob.read(4))
     (algIdHash,) = unpack("<I", blob.read(4))
     (keySize,) = unpack("<I", blob.read(4))
-    keySize = 40 if keySize == 0 else keySize
     (providerType,) = unpack("<I", blob.read(4))
     (reserved1,) = unpack("<I", blob.read(4))
     (reserved2,) = unpack("<I", blob.read(4))
@@ -50,3 +50,25 @@ def _parse_encryptionverifier(blob, algorithm):
         "encryptedVerifierHash": encryptedVerifierHash,
     }
     return verifier
+
+
+def _parse_header_RC4CryptoAPI(encryptionHeader):
+    flags = encryptionHeader.read(4)
+    (headerSize,) = unpack("<I", encryptionHeader.read(4))
+    logger.debug(headerSize)
+    blob = io.BytesIO(encryptionHeader.read(headerSize))
+    header = _parse_encryptionheader(blob)
+    logger.debug(header)
+    # NOTE: https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-offcrypto/36cfb17f-9b15-4a9b-911a-f401f60b3991
+    keySize = 0x00000028 if header["keySize"] == 0 else header["keySize"]
+
+    blob = io.BytesIO(encryptionHeader.read())
+    verifier = _parse_encryptionverifier(blob, "RC4")  # TODO: Fix (cf. ooxml.py)
+    logger.debug(verifier)
+    info = {
+        "salt": verifier["salt"],
+        "keySize": keySize,
+        "encryptedVerifier": verifier["encryptedVerifier"],
+        "encryptedVerifierHash": verifier["encryptedVerifierHash"],
+    }
+    return info
diff --git a/msoffcrypto/format/doc97.py b/msoffcrypto/format/doc97.py
index e1511d3..c3def39 100644
--- a/msoffcrypto/format/doc97.py
+++ b/msoffcrypto/format/doc97.py
@@ -9,7 +9,7 @@
 
 from msoffcrypto import exceptions
 from msoffcrypto.format import base
-from msoffcrypto.format.common import _parse_encryptionheader, _parse_encryptionverifier
+from msoffcrypto.format.common import _parse_header_RC4CryptoAPI
 from msoffcrypto.method.rc4 import DocumentRC4
 from msoffcrypto.method.rc4_cryptoapi import DocumentRC4CryptoAPI
 
@@ -258,25 +258,6 @@ def _parse_header_RC4(encryptionHeader):
     return info
 
 
-def _parse_header_RC4CryptoAPI(encryptionHeader):
-    flags = encryptionHeader.read(4)
-    (headerSize,) = unpack("<I", encryptionHeader.read(4))
-    logger.debug(headerSize)
-    blob = io.BytesIO(encryptionHeader.read(headerSize))
-    header = _parse_encryptionheader(blob)
-    logger.debug(header)
-    blob = io.BytesIO(encryptionHeader.read())
-    verifier = _parse_encryptionverifier(blob, "RC4")  # TODO: Fix (cf. ooxml.py)
-    logger.debug(verifier)
-    info = {
-        "salt": verifier["salt"],
-        "keySize": header["keySize"],
-        "encryptedVerifier": verifier["encryptedVerifier"],
-        "encryptedVerifierHash": verifier["encryptedVerifierHash"],
-    }
-    return info
-
-
 class Doc97File(base.BaseOfficeFile):
     """Return a MS-DOC file object.
 
diff --git a/msoffcrypto/format/ppt97.py b/msoffcrypto/format/ppt97.py
index e518e7e..3162b3f 100644
--- a/msoffcrypto/format/ppt97.py
+++ b/msoffcrypto/format/ppt97.py
@@ -9,7 +9,7 @@
 
 from msoffcrypto import exceptions
 from msoffcrypto.format import base
-from msoffcrypto.format.common import _parse_encryptionheader, _parse_encryptionverifier
+from msoffcrypto.format.common import _parse_header_RC4CryptoAPI
 from msoffcrypto.method.rc4_cryptoapi import DocumentRC4CryptoAPI
 
 logger = logging.getLogger(__name__)
@@ -502,25 +502,6 @@ def construct_persistobjectdirectory(data):
     return persistobjectdirectory
 
 
-def _parse_header_RC4CryptoAPI(encryptionInfo):
-    flags = encryptionInfo.read(4)
-    (headerSize,) = unpack("<I", encryptionInfo.read(4))
-    logger.debug(headerSize)
-    blob = io.BytesIO(encryptionInfo.read(headerSize))
-    header = _parse_encryptionheader(blob)
-    logger.debug(header)
-    blob = io.BytesIO(encryptionInfo.read())
-    verifier = _parse_encryptionverifier(blob, "RC4")  # TODO: Fix (cf. ooxml.py)
-    logger.debug(verifier)
-    info = {
-        "salt": verifier["salt"],
-        "keySize": header["keySize"],
-        "encryptedVerifier": verifier["encryptedVerifier"],
-        "encryptedVerifierHash": verifier["encryptedVerifierHash"],
-    }
-    return info
-
-
 class Ppt97File(base.BaseOfficeFile):
     """Return a MS-PPT file object.
 
diff --git a/msoffcrypto/format/xls97.py b/msoffcrypto/format/xls97.py
index abb8fad..c453290 100644
--- a/msoffcrypto/format/xls97.py
+++ b/msoffcrypto/format/xls97.py
@@ -6,7 +6,7 @@
 
 from msoffcrypto import exceptions
 from msoffcrypto.format import base
-from msoffcrypto.format.common import _parse_encryptionheader, _parse_encryptionverifier
+from msoffcrypto.format.common import _parse_header_RC4CryptoAPI
 from msoffcrypto.method.rc4 import DocumentRC4
 from msoffcrypto.method.rc4_cryptoapi import DocumentRC4CryptoAPI
 from msoffcrypto.method.xor_obfuscation import DocumentXOR
@@ -386,25 +386,6 @@ def _parse_header_RC4(encryptionInfo):
     return info
 
 
-def _parse_header_RC4CryptoAPI(encryptionInfo):
-    flags = encryptionInfo.read(4)
-    (headerSize,) = unpack("<I", encryptionInfo.read(4))
-    logger.debug(headerSize)
-    blob = io.BytesIO(encryptionInfo.read(headerSize))
-    header = _parse_encryptionheader(blob)
-    logger.debug(header)
-    blob = io.BytesIO(encryptionInfo.read())
-    verifier = _parse_encryptionverifier(blob, "RC4")  # TODO: Fix (cf. ooxml.py)
-    logger.debug(verifier)
-    info = {
-        "salt": verifier["salt"],
-        "keySize": header["keySize"],
-        "encryptedVerifier": verifier["encryptedVerifier"],
-        "encryptedVerifierHash": verifier["encryptedVerifierHash"],
-    }
-    return info
-
-
 class _BIFFStream:
     def __init__(self, data):
         self.data = data