From 2cda8e3cb39551e7b2c94297a75d88499423ca0e Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Tue, 6 May 2025 01:03:35 +0200
Subject: [PATCH] make binary attributes iteration NULL terminated

---
 .../symbols/linux/extensions/__init__.py      | 31 ++++++++++++-------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 037ca1f6b..22eb46460 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -191,20 +191,27 @@ class module(generic.GenericIntelProcess):
         else:
             arr_offset = grp.attrs
 
-        symbol_table_name = self.get_symbol_table_name()
-        arr = self._context.object(
-            symbol_table_name + constants.BANG + "array",
-            layer_name=self.vol.layer_name,
-            offset=arr_offset,
-            subtype=self._context.symbol_space.get_type(
-                symbol_table_name + constants.BANG + "pointer"
-            ),
-            count=50,
-        )
+        if not arr_offset.is_readable():
+            vollog.log(
+                constants.LOGLEVEL_V,
+                f"Cannot dereference the pointer to the NULL-terminated list of binary attributes for module at offset {self.vol.offset:#x}",
+            )
+            return 0
 
+        entry = arr_offset.dereference()
+        symbol_table_name = self.get_symbol_table_name()
         idx = 0
-        while arr[idx] and arr[idx].is_readable():
-            idx = idx + 1
+        while entry.is_readable():
+            idx += 1
+            entry = self._context.object(
+                symbol_table_name + constants.BANG + "pointer",
+                layer_name=self.vol.layer_name,
+                offset=entry.vol.offset
+                + self._context.symbol_space.get_type(
+                    symbol_table_name + constants.BANG + "pointer"
+                ).size,
+            )
+
         return idx
 
     @functools.cached_property