Add smear checks in MFT parsing code

volatility3/framework/symbols/windows/extensions/mft.py

@@ -27,6 +27,11 @@ class MFTAttribute(objects.StructType):
     """This represents an MFT ATTRIBUTE"""
 
     def get_resident_filename(self) -> str:
+        # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
+        # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous
+        if self.Attr_Header.ContentOffset > 4194304 or self.Attr_Header.NameLength > 512:
+            return None
+
         # To get the resident name, we jump to relative name offset and read name length * 2 bytes of data
         try:
             name = self._context.object(
@@ -42,6 +47,11 @@ class MFTAttribute(objects.StructType):
             return None
 
     def get_resident_filecontent(self) -> bytes:
+        # smear observed in mass testing of samples
+        # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
+        if self.Attr_Header.ContentOffset > 4194304 or self.Attr_Header.ContentLength > 4194304:
+            return None
+
         # To get the resident content, we jump to relative content offset and read name length * 2 bytes of data
         try:
             bytesobj = self._context.object(