From e24311ff1382bdd9fddc257d08ce307b1adda6c2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 3 Jan 2025 19:42:39 +0000 Subject: [PATCH] Prevent get_vma_iter from returning junk instances --- .../framework/symbols/linux/extensions/__init__.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index b02f80433..d51e75151 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3,6 +3,7 @@ # import abc +import contextlib import collections.abc import logging import functools @@ -856,7 +857,7 @@ class mm_struct(objects.StructType): ) yield vma - def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: + def _do_get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns an iterator for the VMAs in an mm_struct. Automatically choosing the mmap or mm_mt as required.""" if self.has_member("mmap"): @@ -866,6 +867,14 @@ class mm_struct(objects.StructType): else: raise AttributeError("Unable to find mmap or mm_mt in mm_struct") + def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: + """Returns an iterator for the VMAs in an mm_struct. Automatically choosing the mmap or mm_mt as required.""" + + with contextlib.suppress(exceptions.InvalidAddressException): + for vma in self._do_get_vma_iter(): + # this catches invalid instances returned by the internal interator functions + vma.vm_start + yield vma class super_block(objects.StructType): # include/linux/kdev_t.h