From d372f04effff791321f34917dde960805cf698c1 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 3 Jan 2025 19:03:32 +0000 Subject: [PATCH] Add proper exception handling in file descriptor enumeration --- volatility3/framework/symbols/linux/__init__.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index c8a22c7f5..f1a618804 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -339,15 +339,23 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): symbol_table: str, task: interfaces.objects.ObjectInterface, ): - # task.files can be null - if not (task.files and task.files.is_readable()): + try: + files = task.files + except exceptions.InvalidAddressException: + return None + + if not files.is_readable(): + return None + + try: + fd_table = files.get_fds() + except exceptions.InvalidAddressException: return None - fd_table = task.files.get_fds() if fd_table == 0: return None - max_fds = task.files.get_max_fds() + max_fds = files.get_max_fds() # corruption check if max_fds > 500000: