From aecd31f0953142993dc10126be77441b8178dc51 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 13 Sep 2024 16:09:49 +1000 Subject: [PATCH] Add missing pointer verification --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index fd5ddcffa..46bed72aa 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -847,7 +847,7 @@ class dentry(objects.StructType): """Returns the inode associated with this dentry""" inode_ptr = self.d_inode - if not (inode_ptr and inode_ptr.is_valid()): + if not (inode_ptr and inode_ptr.is_readable() and inode_ptr.is_valid()): return None return inode_ptr.dereference() @@ -880,14 +880,14 @@ class struct_file(objects.StructType): # Try first the cached value, kernels +3.9 inode_ptr = self.f_inode - if not (inode_ptr and inode_ptr.is_valid()): + if not (inode_ptr and inode_ptr.is_readable() and inode_ptr.is_valid()): dentry_ptr = self.get_dentry() if not (dentry_ptr and dentry_ptr.is_readable()): return None inode_ptr = dentry_ptr.d_inode - if not (inode_ptr and inode_ptr.is_valid()): + if not (inode_ptr and inode_ptr.is_readable() and inode_ptr.is_valid()): return None return inode_ptr.dereference()