From 1d4893156e04b0feb94249f1dc5536cb39ea2a75 Mon Sep 17 00:00:00 2001
From: David McDonald <dgmcdona@uno.edu>
Date: Mon, 14 Apr 2025 11:13:03 -0500
Subject: [PATCH] Shimcache Extension: Fix logic error in `exec_flag`

Adds needed return statements in `exec_flag` method in order to avoid
`InvalidAddressException` when reading from invalid memory after an
`is_valid` check has already been performed.
---
 .../framework/symbols/windows/extensions/shimcache.py        | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py
index 279a1995c..a80ecc0ea 100644
--- a/volatility3/framework/symbols/windows/extensions/shimcache.py
+++ b/volatility3/framework/symbols/windows/extensions/shimcache.py
@@ -57,12 +57,14 @@ class SHIM_CACHE_ENTRY(objects.StructType):
                 blob_offset, blob_size
             ):
                 self._exec_flag = renderers.UnparsableValue()
+                return self._exec_flag
 
             raw_flag = self._context.layers[self.vol.native_layer_name].read(
                 blob_offset, blob_size
             )
             if not raw_flag:
                 self._exec_flag = renderers.UnparsableValue()
+                return self._exec_flag
 
             try:
                 self._exec_flag = bool(struct.unpack("<I", raw_flag)[0])
@@ -72,6 +74,7 @@ class SHIM_CACHE_ENTRY(objects.StructType):
         else:
             # Always set to true for XP/2K3
             self._exec_flag = renderers.NotApplicableValue()
+
         return self._exec_flag
 
     @property
@@ -118,6 +121,8 @@ class SHIM_CACHE_ENTRY(objects.StructType):
             )
         except AttributeError:
             self._last_updated = renderers.NotApplicableValue()
+        except exceptions.InvalidAddressException:
+            self._last_updated = renderers.UnreadableValue()
 
         return self._last_updated