From 0f9dbe31126a901881b0c4e01367b284990c5fda Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 29 Mar 2017 20:29:19 +0100 Subject: [PATCH] Fix up a small mistake in the interface version checking logic. --- volatility/framework/symbols/intermed.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py index 898a37c69..cc07bb357 100644 --- a/volatility/framework/symbols/intermed.py +++ b/volatility/framework/symbols/intermed.py @@ -107,9 +107,14 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): return cls(context, config_path, name, isf_url, native_types) def _closest_version(self, version, versions): - """Determines the highest suitable handler for specified version format""" + """Determines the highest suitable handler for specified version format + + An interface version such as Current.Age.Revision means that (Current - Age) of the provider must be equal to that of the + consumer, and the provider (the JSON in this instance) must have a greater age (indicating that only additive + changes have been made) than the consumer (in this case, the file reader). + """ supported, age, revision = [int(x) for x in version.split(".")] - supported_versions = [x for x in versions.keys() if x[0] == supported and x[1] >= age] + supported_versions = [x for x in versions.keys() if x[0] == (supported - age) and x[1] >= age] if not supported_versions: raise ValueError( "No Intermediate Format interface versions support file interface version: {}".format(version))