pptx

The code appears to implement legitimate Office-document unpacking and XML normalization, with no direct evidence of malware, credential theft, network exfiltration, or code execution. The primary security issue is unsafe archive extraction without explicit path validation, which can permit arbitrary file overwrite via malicious archive entries; ZIP bomb resource exhaustion is also possible. Review the imported helper modules separately.

A wrapper launches soffice and, when Unix sockets are unavailable, writes C source to a temporary file, compiles it with gcc, and injects the resulting shared library into soffice via LD_PRELOAD. This pattern enables arbitrary native code execution inside the trusted application. The exact payload source (_SHIM_SOURCE) is not provided in the available fragment, so the specific malicious behavior cannot be fully verified from the excerpt.