From afd394dab2d47e3fc2b3f7907b429168cb3b161b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 4 Feb 2021 16:46:55 +0000 Subject: [PATCH] Layers: Don't map intel out-of-bounds addresses --- volatility3/framework/layers/intel.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index cf78bbcd1..89ffcdbaf 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -52,6 +52,7 @@ class Intel(linear.LinearlyMappedLayer): self._index_shift = int(math.ceil(math.log2(struct.calcsize(self._entry_format)))) @classproperty + @functools.lru_cache() def page_size(cls) -> int: """Page size for the intel memory layers. @@ -60,16 +61,19 @@ class Intel(linear.LinearlyMappedLayer): return 1 << cls._page_size_in_bits @classproperty + @functools.lru_cache() def bits_per_register(cls) -> int: """Returns the bits_per_register to determine the range of an IntelTranslationLayer.""" return cls._bits_per_register @classproperty + @functools.lru_cache() def minimum_address(cls) -> int: return 0 @classproperty + @functools.lru_cache() def maximum_address(cls) -> int: return (1 << cls._maxvirtaddr) - 1 @@ -119,6 +123,10 @@ class Intel(linear.LinearlyMappedLayer): position = self._initial_position entry = self._initial_entry + if self.minimum_address > offset > self.maximum_address: + raise exceptions.PagedInvalidAddressException(self.name, offset, position + 1, entry, + "Entry outside virtual address range: " + hex(entry)) + # Run through the offset in various chunks for (name, size, large_page) in self._structure: # Check we're valid