From e9088be0d86fa2f68774d47371ebd2736287f1c5 Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Sat, 28 Dec 2024 22:46:39 +0000
Subject: [PATCH 1/2] Prevent infinite looping and out of memory errors #1482

---
 .../framework/symbols/windows/extensions/registry.py     | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py
index c9544a8ba..b282b13cf 100644
--- a/volatility3/framework/symbols/windows/extensions/registry.py
+++ b/volatility3/framework/symbols/windows/extensions/registry.py
@@ -133,8 +133,17 @@ class CM_KEY_BODY(objects.StructType):
 
     def get_full_key_name(self) -> str:
         output = []
+        seen = set()
+
         kcb = self.KeyControlBlock
         while kcb.ParentKcb:
+            if kcb.ParentKcb.vol.offset in seen:
+                return ""
+            seen.add(kcb.ParentKcb.vol.offset)
+
+            if len(output) > 128:
+                return ""
+
             if kcb.NameBlock.Name is None:
                 break
 

From 506a61d8846e6a3399ab1f964d41b09a197592a6 Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Fri, 24 Jan 2025 22:09:24 +0000
Subject: [PATCH 2/2] Address feedback

---
 volatility3/framework/plugins/windows/handles.py             | 4 ++--
 volatility3/framework/symbols/windows/extensions/registry.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py
index 38ccfbfbc..6a391fe35 100644
--- a/volatility3/framework/plugins/windows/handles.py
+++ b/volatility3/framework/plugins/windows/handles.py
@@ -341,7 +341,7 @@ class Handles(interfaces.plugins.PluginInterface):
                         try:
                             obj_name = entry.NameInfo.Name.String
                         except (ValueError, exceptions.InvalidAddressException):
-                            obj_name = ""
+                            obj_name = None
 
                 except exceptions.InvalidAddressException:
                     vollog.log(
@@ -359,7 +359,7 @@ class Handles(interfaces.plugins.PluginInterface):
                         format_hints.Hex(entry.HandleValue),
                         obj_type,
                         format_hints.Hex(entry.GrantedAccess),
-                        obj_name,
+                        obj_name or renderers.NotAvailableValue(),
                     ),
                 )
 
diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py
index b282b13cf..a8cc7703c 100644
--- a/volatility3/framework/symbols/windows/extensions/registry.py
+++ b/volatility3/framework/symbols/windows/extensions/registry.py
@@ -138,11 +138,11 @@ class CM_KEY_BODY(objects.StructType):
         kcb = self.KeyControlBlock
         while kcb.ParentKcb:
             if kcb.ParentKcb.vol.offset in seen:
-                return ""
+                return None
             seen.add(kcb.ParentKcb.vol.offset)
 
             if len(output) > 128:
-                return ""
+                return None
 
             if kcb.NameBlock.Name is None:
                 break