From 2759df89dbf38ba3bd515624642db527b16b03e6 Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Tue, 6 May 2025 00:31:09 +0200
Subject: [PATCH] tag potentially smeared dentry names

---
 volatility3/framework/symbols/linux/__init__.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py
index fbe0fdad3..65f20d88d 100644
--- a/volatility3/framework/symbols/linux/__init__.py
+++ b/volatility3/framework/symbols/linux/__init__.py
@@ -169,6 +169,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
             return ""
 
         path_reversed = []
+        smeared = False
         while (
             dentry
             and dentry.is_readable()
@@ -190,14 +191,16 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface):
 
             parent = dentry.d_parent
             dname = dentry.d_name.name_as_str()
-            dname_stripped = dname.strip("/")
-            if dname_stripped:
-                path_reversed.append(dname_stripped)
+            # empty dentry names are most likely
+            # the result of smearing
+            if not dname:
+                smeared = True
+            path_reversed.append(dname.strip("/"))
             dentry = parent
 
-        if path_reversed == []:
-            return ""
         path = "/" + "/".join(reversed(path_reversed))
+        if smeared:
+            return f"<potentially smeared> {path}"
         return path
 
     @classmethod