From 8373b5ed5ac8fe73a67c2d0c8b4f69367d60e9d0 Mon Sep 17 00:00:00 2001 From: cstation Date: Sat, 22 Jul 2023 18:52:39 +0200 Subject: [PATCH] Push ELF export limit to a constant --- volatility3/framework/constants/linux/__init__.py | 2 ++ volatility3/framework/plugins/linux/elfs.py | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 1b133eb42..ba7181db8 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -234,3 +234,5 @@ BLUETOOTH_PROTOCOLS = ( "HIDP", "AVDTP", ) + +ELF_MAX_EXTRACTION_SIZE = 1024 * 1024 * 1024 * 4 - 1 diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index 23bdf1c3a..c6334c977 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -105,8 +105,9 @@ class Elfs(plugins.PluginInterface): real_size = end - start - if real_size < 0 or real_size > 100000000: - continue + # Check if ELF has a legitimate size + if real_size < 0 or real_size > constants.linux.ELF_MAX_EXTRACTION_SIZE: + raise ValueError(f"The claimed size of the ELF is invalid: {real_size}") sections[start] = real_size