From 1f6fcd7badf92f7bf62e0f5e4ab6088d1e801a19 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 7 Dec 2016 09:52:33 +0000 Subject: [PATCH] Ensure that the value of pointers always fall within their layer. --- volatility/framework/objects/__init__.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/volatility/framework/objects/__init__.py b/volatility/framework/objects/__init__.py index 4332a3776..4dd712ab7 100644 --- a/volatility/framework/objects/__init__.py +++ b/volatility/framework/objects/__init__.py @@ -155,6 +155,19 @@ class Pointer(Integer): struct_format = struct_format) self._vol['subtype'] = subtype + @classmethod + def _struct_value(cls, context, struct_format, layer_name, offset): + """Ensure that pointer values always fall within the address space of the layer they're constructed on + + If there's a need for all the data within the address, the pointer should be recast. The "pointer" + must always live within the space (even if the data provided is invalid). + """ + length = struct.calcsize(struct_format) + mask = context.memory[layer_name].address_mask + data = context.memory.read(layer_name, offset, length) + (value,) = struct.unpack(struct_format, data) + return value & mask + def dereference(self, layer_name = None): """Dereferences the pointer