diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index c8a22c7f5..f1a618804 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -339,15 +339,23 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): symbol_table: str, task: interfaces.objects.ObjectInterface, ): - # task.files can be null - if not (task.files and task.files.is_readable()): + try: + files = task.files + except exceptions.InvalidAddressException: + return None + + if not files.is_readable(): + return None + + try: + fd_table = files.get_fds() + except exceptions.InvalidAddressException: return None - fd_table = task.files.get_fds() if fd_table == 0: return None - max_fds = task.files.get_max_fds() + max_fds = files.get_max_fds() # corruption check if max_fds > 500000: