From 7a0b71f7aedeb479e2adb3d4949208966e4a0b23 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 11 Jul 2019 15:19:40 +0100 Subject: [PATCH] Fix an issue we hit 1 in 1000 times. Turns out, that because the name consumption is fairly lax (often lots of excess space after the name, etc) we were reading 2 too many bytes (because we weren't taken the length of the leaf off the available length). This would error when it so happened that a structure was at the end of the type list and we'd read past the end of the tpi stream. --- volatility/framework/symbols/windows/mspdb.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility/framework/symbols/windows/mspdb.py b/volatility/framework/symbols/windows/mspdb.py index ad010e9e6..0eac8ebbb 100644 --- a/volatility/framework/symbols/windows/mspdb.py +++ b/volatility/framework/symbols/windows/mspdb.py @@ -722,6 +722,7 @@ class PdbReader: module.get_enumeration("LEAF_TYPE"), layer_name = module._layer_name, offset = offset) consumed = leaf_type.vol.base_type.size offset += consumed + length -= consumed if leaf_type in [ leaf_type.LF_CLASS, leaf_type.LF_CLASS_ST, leaf_type.LF_STRUCTURE, leaf_type.LF_STRUCTURE_ST,