search

TimsterMon / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
0 stars 0 forks source link

MFTParser crashes #423

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Run the mftparser plugin on the joshua1 memory image. 
http://jessekornblum.livejournal.com/293291.html. 

$ python vol.py -f joshua1.vmem --profile=Win7SP1x64 mftparser

What is the expected output? What do you see instead?

The program crashes:
Traceback (most recent call last):
  File "vol.py", line 186, in <module>
    main()
  File "vol.py", line 177, in main
    command.execute()
  File "/Users/jessek/Dropbox/volatility/trunk/volatility/commands.py", line 87, in execute
    data = self.calculate()
  File "/Users/jessek/Dropbox/volatility/trunk/volatility/plugins/mftparser.py", line 584, in calculate
    contents = mft_buff[start:theend]
TypeError: slice indices must be integers or None or have an __index__ method

What version of the product are you using? On what operating system?

Trunk code, revision 3424.

Please provide any additional information below.

The problem appears to be the array bounds 'start' and 'theend'. The attached 
patch adds a check on those values.

Original issue reported on code.google.com by jessekornblum on 24 May 2013 at 3:02

Attachments:

GoogleCodeExporter commented 9 years ago 
This issue was closed by revision r3426.

Original comment by jamie.l...@gmail.com on 24 May 2013 at 9:21