Layers: Add in check and document scanner behaviour

volatility/framework/interfaces/layers.py

@@ -328,6 +328,9 @@ class DataLayerInterface(interfaces.configuration.ConfigurableInterface, metacla
                 vollog.debug("Invalid address in layer {} found scanning {} at address {:x}".format(
                     layer_name, self.name, address))
 
+        if len(data) > scanner.chunk_size + scanner.overlap:
+            vollog.debug("Scan chunk too large: {}".format(hex(len(data))))
+
         progress.value = chunk_end
         return list(scanner(data, chunk_end - len(data)))
 

volatility/framework/layers/scanners/__init__.py

@@ -21,6 +21,8 @@ class BytesScanner(layers.ScannerInterface):
         where the needle is found."""
         find_pos = data.find(self.needle)
         while find_pos >= 0:
+            # Ensure that if we're in the overlap, we don't report it
+            # It'll be returned when the next block is scanned
             if find_pos < self.chunk_size:
                 yield find_pos + data_offset
             find_pos = data.find(self.needle, find_pos + 1)