fix bug #81411

MsBinaryFile/PptFile/Reader/PPTDocumentInfoOneUser.cpp

@@ -39,6 +39,7 @@
  //#include "../Records/SoundCollectionContainer.h"
  //#include "../Records/SoundContainer.h"
 #include "../Enums/_includer.h"
+#include "../../../OfficeCryptReader/source/CryptTransform.h"
 
 using namespace PPT;
 using namespace ODRAW;
@@ -174,17 +175,28 @@ bool CPPTUserInfo::ReadFromStream(CRecordUserEditAtom* pUser, POLE::Stream* pStr
             m_bEncrypt = true;
             m_oEncryptionHeader.ReadFromStream(oHeader, pStream);
 
-            m_pDecryptor = new CRYPT::ECMADecryptor();
-            m_pDecryptor->SetCryptData(m_oEncryptionHeader.crypt_data_aes);
-
-            if (m_strPassword.empty())
+            if (m_oEncryptionHeader.bStandard)
             {
-                if (m_pDecryptor->SetPassword(L"VelvetSweatshop") == false)
+                m_pDecryptor = new CRYPT::RC4Decryptor(m_oEncryptionHeader.crypt_data_rc4,
+                    m_strPassword.empty() ? L"VelvetSweatshop" : m_strPassword);
+                if (!m_pDecryptor->IsVerify())
                     return false;
             }
-            else if (m_pDecryptor->SetPassword(m_strPassword) == false)
+            else
             {
-                return false;
+                CRYPT::ECMADecryptor* ecmaDecryptor = new CRYPT::ECMADecryptor();
+                ecmaDecryptor->SetCryptData(m_oEncryptionHeader.crypt_data_aes);
+                m_pDecryptor = ecmaDecryptor;
+
+                if (m_strPassword.empty())
+                {
+                    if (ecmaDecryptor->SetPassword(L"VelvetSweatshop") == false)
+                        return false;
+                }
+                else if (ecmaDecryptor->SetPassword(m_strPassword) == false)
+                {
+                    return false;
+                }
             }
             std::wstring sTemp = m_pDocumentInfo->m_pCommonInfo->tempPath + FILE_SEPARATOR_STR + L"~tempFile.ppt";
 

MsBinaryFile/PptFile/Reader/PPTDocumentInfoOneUser.h

@@ -58,7 +58,7 @@ public:
     CEncryptionHeader               m_oEncryptionHeader;
     bool                            m_bEncrypt;
     std::wstring                    m_strPassword;
-    CRYPT::ECMADecryptor*           m_pDecryptor;
+    CRYPT::Decryptor*               m_pDecryptor;
     POLE::Storage*                  m_pStorageDecrypt;
     std::vector<XLS::CFStreamPtr>   m_arStreamDecrypt; // each Persist has its own ... o_O
 

MsBinaryFile/PptFile/Reader/PPTFileReader.cpp

@@ -254,7 +254,7 @@ void CPPTFileReader::ReadPictures()
 	XLS::CFStreamPtr pStream = GetPictureStream();
 	if (!pStream) return;
 
-	CRYPT::ECMADecryptor *pDecryptor = m_oDocumentInfo.m_arUsers[0]->m_pDecryptor;
+	CRYPT::Decryptor *pDecryptor = m_oDocumentInfo.m_arUsers[0]->m_pDecryptor;
 
 	while (true)
 	{

MsBinaryFile/PptFile/Reader/ReadStructures.cpp

@@ -674,7 +674,7 @@ CMetaHeader::CMetaHeader()
 {
 }
 
-void CMetaHeader::FromStream(POLE::Stream* pStream, CRYPT::ECMADecryptor *pDecryptor)
+void CMetaHeader::FromStream(POLE::Stream* pStream, CRYPT::Decryptor *pDecryptor)
 {
     BYTE	pData[34];
     pStream->read(pData, 34);

MsBinaryFile/PptFile/Reader/ReadStructures.h

@@ -37,7 +37,7 @@
 
 namespace CRYPT
 {
-class ECMADecryptor;
+class Decryptor;
 }
 namespace PPT
 {
@@ -151,7 +151,7 @@ public:
 
 public:
     CMetaHeader();
-    void FromStream(POLE::Stream* pStream, CRYPT::ECMADecryptor *pDecryptor = NULL);
+    void FromStream(POLE::Stream* pStream, CRYPT::Decryptor *pDecryptor = NULL);
 
     void ToEMFHeader(Gdiplus::ENHMETAHEADER3* pHeader);
     void ToWMFHeader(Gdiplus::WmfPlaceableFileHeader* pHeader);

MsBinaryFile/PptFile/Records/CryptSession10Container.cpp

@@ -110,20 +110,9 @@ void CEncryptionHeader::ReadFromStream(SRecordHeader &oHeader, POLE::Stream *pSt
         int Reserved1	= StreamUtils::ReadDWORD(pStream);
         int Reserved2	= StreamUtils::ReadDWORD(pStream);
 
-        POLE::uint64 pos	= pStream->tell();
-        POLE::uint64 size	= pStream->size();
+        // skip csp name
+        pStream->seek(pos_start_record + 12 + HeaderSize); 
 
-        std::vector<char> dataCSPName;
-        while(pos  < size - 1)
-        {
-            dataCSPName.push_back(StreamUtils::ReadBYTE(pStream));
-            dataCSPName.push_back(StreamUtils::ReadBYTE(pStream));
-            if (dataCSPName[dataCSPName.size() - 1] == 0 && dataCSPName[dataCSPName.size() - 2] == 0)
-            {
-                break;
-            }
-            pos+=2;//unicode null-terminate string
-        }
         //EncryptionVerifier
         crypt_data_aes.saltSize = StreamUtils::ReadDWORD(pStream);
         crypt_data_aes.saltValue = StreamUtils::ReadStringA(pStream, crypt_data_aes.saltSize);
@@ -135,8 +124,6 @@ void CEncryptionHeader::ReadFromStream(SRecordHeader &oHeader, POLE::Stream *pSt
         int szEncryptedVerifierHash = (ProviderType == 0x0001) ? 0x14 : 0x20;
         crypt_data_aes.encryptedVerifierValue = StreamUtils::ReadStringA(pStream, szEncryptedVerifierHash);
 
-        pos = pStream->tell();
-
         //------------------------------------------------------------------------------------------
         switch(AlgIDHash)
         {

MsBinaryFile/PptFile/Records/Drawing/ArtBlip.cpp

@@ -49,7 +49,7 @@ void CRecordOfficeArtBlip::ReadFromStream(SRecordHeader & oHeader, POLE::Stream*
 {
 	if ((oHeader.RecVersion == PSFLAG_CONTAINER) || ((oHeader.RecVersion & 0x0F) == 0x0F)) return;
 	
-	CRYPT::ECMADecryptor *pDecryptor = m_pDocumentInfo ? m_pDocumentInfo->m_arUsers[0]->m_pDecryptor : NULL;
+	CRYPT::Decryptor *pDecryptor = m_pDocumentInfo ? m_pDocumentInfo->m_arUsers[0]->m_pDecryptor : NULL;
 
 	CMetaFileBuffer	oMetaFile;
 	std::wstring sExt = L".jpg";

OfficeCryptReader/source/CryptTransform.cpp

@@ -336,10 +336,13 @@ _buf GenerateHashKey(_buf & salt, _buf & password, int hashSize, int keySize, in
         pHashBuf = HashAppend(iterator, pHashBuf, algorithm);
 	}
 
-    pHashBuf = HashAppend( pHashBuf, block, algorithm);
-	
+	pHashBuf = HashAppend(pHashBuf, block, algorithm);
+
 	if (spin == 0)
 	{
+		CorrectHashSize(pHashBuf, keySize, 0);
+		if (keySize == 5)
+			CorrectHashSize(pHashBuf, 16, 0); //40-bit crypt key !!!
 		return _buf(pHashBuf.ptr, pHashBuf.size);
 	}
 
@@ -619,14 +622,14 @@ bool ECMADecryptor::SetPassword(std::wstring _password)
 	}
 	else
 	{
-		_buf verifierKey = GenerateHashKey(pSalt, pPassword, cryptData.hashSize, cryptData.keySize, cryptData.spinCount, cryptData.hashAlgorithm);		
+		_buf verifierKey = GenerateHashKey(pSalt, pPassword, cryptData.hashSize, cryptData.keySize, cryptData.spinCount, cryptData.hashAlgorithm);
 
 		if (cryptData.cipherAlgorithm == CRYPT_METHOD::RC4)
 		{
-			rc4Decryption.SetKey(verifierKey.ptr, cryptData.keySize);
+			rc4Decryption.SetKey(verifierKey.ptr, verifierKey.size);
 		}
 //--------------------------------------------
-		_buf decryptedVerifierHashInputBytes;		
+		_buf decryptedVerifierHashInputBytes;
 		DecryptCipher(verifierKey, pSalt, pEncVerInput, decryptedVerifierHashInputBytes, cryptData.cipherAlgorithm);
 
 	//--------------------------------------------
@@ -686,8 +689,8 @@ void ECMADecryptor::Decrypt(char* data	, const size_t size, const unsigned long
 			_buf pSalt		(cryptData.saltValue);			
 			
 			_buf hashKey = GenerateHashKey(pSalt, pPassword, cryptData.hashSize, cryptData.keySize, cryptData.spinCount, cryptData.hashAlgorithm, block_index);
-			
-			rc4Decryption.SetKey(hashKey.ptr, cryptData.keySize);
+
+			rc4Decryption.SetKey(hashKey.ptr, hashKey.size);
 		}
 
 		const long offset = nCurrPos % block_size;
@@ -814,10 +817,10 @@ void ECMADecryptor::Decrypt(unsigned char* data_inp, int size, unsigned char*& d
 	else
 	{				
 		_buf hashKey = GenerateHashKey(pSalt, pPassword, cryptData.hashSize, cryptData.keySize, cryptData.spinCount, cryptData.hashAlgorithm, start_iv_block);
-		
+
 		if (cryptData.cipherAlgorithm == CRYPT_METHOD::RC4)
-		{			
-			rc4Decryption.SetKey(hashKey.ptr, cryptData.keySize);
+		{
+			rc4Decryption.SetKey(hashKey.ptr, hashKey.size);
 		}
 	
 		_buf pInp(data_inp, size, false);

OfficeCryptReader/source/CryptTransform.h

@@ -67,6 +67,7 @@ namespace CRYPT
 class Decryptor
 {
 	public:
+		virtual ~Decryptor() {}
 		virtual void Decrypt(char* data, const size_t size, const unsigned long stream_pos, const size_t block_size) = 0;
 		virtual void Decrypt(char* data, const size_t size, const unsigned long block_index) = 0;
 		virtual bool SetPassword(std::wstring password) = 0;