From 437c611cb9a01e24323fbcb225b757280334c5aa Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:45:38 +0000 Subject: [PATCH] Avoid smear in module enumeration paths --- volatility3/framework/plugins/linux/check_modules.py | 6 +++++- .../framework/symbols/linux/utilities/tainting.py | 10 ++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 0ed638d9c..23da29680 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -65,7 +65,11 @@ class Check_modules(plugins.PluginInterface): mod = mod_kobj.mod - name = utility.pointer_to_string(kobj.name, 32) + try: + name = utility.pointer_to_string(kobj.name, 32) + except exceptions.InvalidAddressException: + continue + if kobj.name and kobj.reference_count() > 2: ret[name] = mod diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index 2360401d5..cb81ab1a3 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -93,8 +93,14 @@ class Tainting(interfaces.configuration.VersionableInterface): ): if is_module and not taint_flag.module: continue - c_true = chr(taint_flag.c_true) - c_false = chr(taint_flag.c_false) + + try: + c_true = chr(taint_flag.c_true) + c_false = chr(taint_flag.c_false) + except ValueError: + # thrown when the c_true or c_false values are out of range + continue + if taints & (1 << taint_bit): taints_string += c_true elif c_false != " ":