Skip to content

Commit cae7930

Browse files
authored
Merge pull request #1490 from volatilityfoundation/issue_1482_infinite_loop_oom
Prevent infinite looping and out of memory errors #1482
2 parents 45e7f34 + 506a61d commit cae7930

File tree

2 files changed

+11
-2
lines changed

2 files changed

+11
-2
lines changed

volatility3/framework/plugins/windows/handles.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -341,7 +341,7 @@ def _generator(self, procs):
341341
try:
342342
obj_name = entry.NameInfo.Name.String
343343
except (ValueError, exceptions.InvalidAddressException):
344-
obj_name = ""
344+
obj_name = None
345345

346346
except exceptions.InvalidAddressException:
347347
vollog.log(
@@ -359,7 +359,7 @@ def _generator(self, procs):
359359
format_hints.Hex(entry.HandleValue),
360360
obj_type,
361361
format_hints.Hex(entry.GrantedAccess),
362-
obj_name,
362+
obj_name or renderers.NotAvailableValue(),
363363
),
364364
)
365365

volatility3/framework/symbols/windows/extensions/registry.py

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,8 +133,17 @@ def _skip_key_hive_entry_path(self, kcb_flags):
133133

134134
def get_full_key_name(self) -> str:
135135
output = []
136+
seen = set()
137+
136138
kcb = self.KeyControlBlock
137139
while kcb.ParentKcb:
140+
if kcb.ParentKcb.vol.offset in seen:
141+
return None
142+
seen.add(kcb.ParentKcb.vol.offset)
143+
144+
if len(output) > 128:
145+
return None
146+
138147
if kcb.NameBlock.Name is None:
139148
break
140149

0 commit comments

Comments
 (0)