mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-24 02:24:51 +02:00
linux:sockstat plugin and list_sockets API: improve pointers validation
This commit is contained in:
@@ -438,7 +438,7 @@ class Sockstat(plugins.PluginInterface):
|
||||
"""Lists all network connections for all processes."""
|
||||
|
||||
_required_framework_version = (2, 0, 0)
|
||||
_version = (3, 0, 2)
|
||||
_version = (3, 0, 3)
|
||||
|
||||
@classmethod
|
||||
def get_requirements(cls):
|
||||
@@ -514,25 +514,28 @@ class Sockstat(plugins.PluginInterface):
|
||||
fd_num, filp, _full_path = fd_internal.fd_fields
|
||||
task = fd_internal.task
|
||||
|
||||
if not (filp.f_op and filp.f_op.is_readable()):
|
||||
continue
|
||||
|
||||
if filp.f_op not in (sfop_addr, dfop_addr):
|
||||
continue
|
||||
|
||||
dentry = filp.get_dentry()
|
||||
if not dentry:
|
||||
if not (dentry and dentry.is_readable()):
|
||||
continue
|
||||
|
||||
d_inode = dentry.d_inode
|
||||
if not d_inode:
|
||||
if not (d_inode and d_inode.is_readable()):
|
||||
continue
|
||||
|
||||
socket_alloc = linux.LinuxUtilities.container_of(
|
||||
d_inode, "socket_alloc", "vfs_inode", vmlinux
|
||||
)
|
||||
socket = socket_alloc.socket
|
||||
|
||||
if not (socket and socket.sk):
|
||||
if not socket_alloc:
|
||||
continue
|
||||
socket = socket_alloc.socket
|
||||
if not (socket.sk and socket.sk.is_readable()):
|
||||
continue
|
||||
|
||||
sock = socket.sk.dereference()
|
||||
|
||||
sock_type = sock.get_type()
|
||||
|
||||
Reference in New Issue
Block a user