From 35d47b0fb0ebb839e779365d4e1c22165dc5e93e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 11 Nov 2017 15:15:14 +0000 Subject: [PATCH] Improve checks for invalid values We determine address_masks using log/ln2, which cannot accept 0. Therefore we don't support address spaces with a maximum_address of 0. This can affect registry hives, so we've added a check in registry hives to prevent creating layers with invalid maximum_addresses. --- volatility/framework/exceptions.py | 4 ++++ volatility/framework/layers/registry.py | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/volatility/framework/exceptions.py b/volatility/framework/exceptions.py index d918a1742..09078eb6f 100644 --- a/volatility/framework/exceptions.py +++ b/volatility/framework/exceptions.py @@ -52,3 +52,7 @@ class SymbolSpaceError(VolatilityException): class LayerException(VolatilityException): """Thrown when an error occurs dealing with memory and layers""" + + +class StructureException(VolatilityException): + """Thrown when an error occurs dealing with an expected structure type""" diff --git a/volatility/framework/layers/registry.py b/volatility/framework/layers/registry.py index 25b5fa7eb..185d4f92a 100644 --- a/volatility/framework/layers/registry.py +++ b/volatility/framework/layers/registry.py @@ -46,7 +46,9 @@ class RegistryHive(interfaces.layers.TranslationLayerInterface): self._minaddr = 0 self._maxaddr = self._base_block.Length - # print("MAPPING", self.mapping(self._base_block.RootCell, length = 2)) + if self._base_block.Length <= 0: + raise exceptions.StructureException( + "Invalid registry base_block length: {}".format(self._base_block.Length)) @property def address_mask(self):