From 2db214e2f852bd887c282bec074942607de8591e Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 8 Nov 2017 01:00:53 +0000
Subject: [PATCH] Ensure we appropriately truncate unicode strings.

---
 volatility/framework/layers/registry.py                     | 5 ++---
 volatility/framework/symbols/windows/extensions/registry.py | 6 +++++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py
index b54f36033..e947392cb 100644
--- a/volatility/framework/layers/registry.py
+++ b/volatility/framework/layers/registry.py
@@ -91,11 +91,10 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface):
         if key.endswith("\\"):
             key = key[:-1]
         key_array = key.split('\\')
-        depth = 0
         found_key = []
-        while len(key_array) > 1 and node_key:
+        while key_array and node_key:
             for subkey in node_key.get_subkeys():
-                if subkey.keyname == key_array[depth]:
+                if subkey.helper_name == key_array[0]:
                     node_key = subkey
                     found_key, key_array = found_key + [key_array[0]], key_array[1:]
                     break
diff --git a/volatility/framework/symbols/windows/extensions/registry.py b/volatility/framework/symbols/windows/extensions/registry.py
index 40ca28d17..ee086a124 100644
--- a/volatility/framework/symbols/windows/extensions/registry.py
+++ b/volatility/framework/symbols/windows/extensions/registry.py
@@ -142,7 +142,11 @@ class _CM_KEY_VALUE(objects.Struct):
                 raise ValueError("Size of data does not match the type of registry value {}".format(self.helper_name))
             return struct.unpack("<Q", data)[0]
         if self_type in [RegValueTypes.REG_SZ, RegValueTypes.REG_EXPAND_SZ, RegValueTypes.REG_LINK]:
-            return str(data, encoding = "utf-16-le")
+            # truncate after \x00\x00 to ensure it can
+            output = str(data, encoding = "utf-16-le", errors = 'replace')
+            if output.find("\x00") > 0:
+                output = output[:output.find("\x00")]
+            return output
         if self_type == RegValueTypes.REG_MULTI_SZ:
             return str(data, encoding = "utf-16-le").split("\x00")
         if self_type == RegValueTypes.REG_BINARY: