diff --git a/volatility/framework/exceptions.py b/volatility/framework/exceptions.py index d918a1742..09078eb6f 100644 --- a/volatility/framework/exceptions.py +++ b/volatility/framework/exceptions.py @@ -52,3 +52,7 @@ class SymbolSpaceError(VolatilityException): class LayerException(VolatilityException): """Thrown when an error occurs dealing with memory and layers""" + + +class StructureException(VolatilityException): + """Thrown when an error occurs dealing with an expected structure type""" diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 25b5fa7eb..185d4f92a 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -46,7 +46,9 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): self._minaddr = 0 self._maxaddr = self._base_block.Length - # print("MAPPING", self.mapping(self._base_block.RootCell, length = 2)) + if self._base_block.Length <= 0: + raise exceptions.StructureException( + "Invalid registry base_block length: {}".format(self._base_block.Length)) @property def address_mask(self):