Cleanup vnode processing and smear protection based on @fgomulka testing

volatility3/framework/symbols/mac/extensions/__init__.py

@@ -4,12 +4,15 @@
 
 from typing import Generator, Iterable, Optional, Set, Tuple
 
+import logging
+
 from volatility3.framework import constants, objects, renderers
 from volatility3.framework import exceptions, interfaces
 from volatility3.framework.objects import utility
 from volatility3.framework.renderers import conversion
 from volatility3.framework.symbols import generic
 
+vollog = logging.getLogger(__name__)
 
 class proc(generic.GenericIntelProcess):
 
@@ -51,7 +54,15 @@ class proc(generic.GenericIntelProcess):
         seen: Set[int] = set()
 
         for i in range(task.map.hdr.nentries):
-            if not current_map or current_map.vol.offset in seen:
+            if (not current_map or
+                current_map.vol.offset in seen or
+                not self._context.layers[task.vol.native_layer_name].is_valid(current_map.dereference().vol.offset, current_map.dereference().vol.size)):
+
+                vollog.log(constants.LOGLEVEL_VVV, "Breaking process maps iteration due to invalid state.")
+                break
+
+            # ZP_POISON value used to catch programming errors
+            if current_map.links.start == 0xdeadbeefdeadbeef or current_map.links.end == 0xdeadbeefdeadbeef:
                 break
 
             yield current_map
@@ -210,10 +221,21 @@ class vm_map_entry(objects.StructType):
             ret = node
         elif node:
             path = []
-            while node:
-                v_name = utility.pointer_to_string(node.v_name, 255)
+            seen: Set[int] = set()
+            while node and node.vol.offset not in seen:
+                try:
+                    v_name = utility.pointer_to_string(node.v_name, 255)
+                except exceptions.InvalidAddressException:
+                    break
+
                 path.append(v_name)
+                if len(path) > 1024:
+                    break
+
+                seen.add(node.vol.offset)
+
                 node = node.v_parent
+
             path.reverse()
             ret = "/" + "/".join(path)
         else:
@@ -243,9 +265,10 @@ class vm_map_entry(objects.StructType):
 
         # based on find_vnode_object
         vnode_object = self.get_object().get_map_object()
+        if vnode_object == 0:
+            return None
 
         found_end = False
-
         while not found_end:
             try:
                 tmp_vnode_object = vnode_object.shadow.dereference()
@@ -257,8 +280,15 @@ class vm_map_entry(objects.StructType):
             else:
                 vnode_object = tmp_vnode_object
 
+        if vnode_object.vol.offset == 0:
+            return None
+
         try:
-            ops = vnode_object.pager.mo_pager_ops.dereference()
+            pager = vnode_object.pager
+            if pager == 0:
+                return None
+
+            ops = pager.mo_pager_ops.dereference()
         except exceptions.InvalidAddressException:
             return None