From f584be8d18cdc91fed29699515259a0a28f8dad3 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Mon, 3 Sep 2018 21:39:48 +0100
Subject: [PATCH] Fix up the linux symbol caching code.

---
 .../framework/automagic/linux_symbol_cache.py | 22 ++++++++++++-------
 volatility/framework/symbols/intermed.py      |  6 +++--
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/volatility/framework/automagic/linux_symbol_cache.py b/volatility/framework/automagic/linux_symbol_cache.py
index 1d4006562..d8870e5b8 100644
--- a/volatility/framework/automagic/linux_symbol_cache.py
+++ b/volatility/framework/automagic/linux_symbol_cache.py
@@ -23,26 +23,32 @@ class LinuxSymbolCache(interfaces.automagic.AutomagicInterface):
 
     @classmethod
     def load_linux_banners(cls) -> LinuxBanners:
-        linuxbanners = {}  # type: LinuxBanners
+        linux_banners = {}  # type: LinuxBanners
         if os.path.exists(constants.LINUX_BANNERS_PATH):
             with open(constants.LINUX_BANNERS_PATH, "rb") as f:
                 # We use pickle over JSON because we're dealing with bytes objects
-                linuxbanners.update(pickle.load(f))
+                linux_banners.update(pickle.load(f))
 
         # Remove possibilities that can't exist locally.
-        for banner in linuxbanners:
-            for path in linuxbanners[banner]:
+        remove_banners = []
+        for banner in linux_banners:
+            for path in linux_banners[banner]:
                 url = urllib.parse.urlparse(path)
                 if url.scheme == 'file' and not os.path.exists(urllib.request.url2pathname(url.path)):
                     vollog.log(constants.LOGLEVEL_V,
                                "Removing cached path {} for banner {}: file does not exist".format(path, banner))
-                    linuxbanners[banner].remove(path)
-        return linuxbanners
+                    linux_banners[banner].remove(path)
+            if not linux_banners[banner]:
+                remove_banners.append(banner)
+        for remove_banner in remove_banners:
+            del linux_banners[remove_banner]
+        return linux_banners
 
     @classmethod
-    def save_linux_banners(cls, linuxbanners):
+    def save_linux_banners(cls, linux_banners):
+
         with open(constants.LINUX_BANNERS_PATH, "wb") as f:
-            pickle.dump(linuxbanners, f)
+            pickle.dump(linux_banners, f)
 
     def __call__(self, context, config_path, configurable, progress_callback = None):
         """Runs the automagic over the configurable"""
diff --git a/volatility/framework/symbols/intermed.py b/volatility/framework/symbols/intermed.py
index 839951266..1adad44d2 100644
--- a/volatility/framework/symbols/intermed.py
+++ b/volatility/framework/symbols/intermed.py
@@ -139,8 +139,10 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface):
         extensions = ['.json', '.json.xz', '.json.gz', '.json.bz2']
         if filename is None:
             filename = "*"
-        # For zipfiles, the path separator is always "/", so we need to ch
-        zip_match = "/".join(os.path.split(filename))
+            zip_match = filename
+        else:
+            # For zipfiles, the path separator is always "/", so we need to change the path
+            zip_match = "/".join(os.path.split(filename))
 
         # Check user symbol directory first, then fallback to the framework's library to allow for overloading
         for path in volatility.symbols.__path__: