kkchauhan / volatility

Automatically exported from code.google.com/p/volatility
GNU General Public License v2.0
0 stars 0 forks source link

FileAddressSpace is_valid_address() returns True on -1 #427

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
if you do something like FileAddressSpace.is_valid_address(-1) or 
FileAddressSpace.is_valid_address(-181827371) it will return True. 

we probably need to do something like this? 

Index: volatility/plugins/addrspaces/standard.py
===================================================================
--- volatility/plugins/addrspaces/standard.py   (revision 3435)
+++ volatility/plugins/addrspaces/standard.py   (working copy)
@@ -120,7 +120,7 @@
     def is_valid_address(self, addr):
         if addr == None:
             return False
-        return addr < self.fsize
+        return addr > 0 and addr < self.fsize

     def close(self):
         self.fhandle.close()

this is only part of a bug i've been trying to track down. more info coming. 
lmk if you have thoughts on this first part though. 

Original issue reported on code.google.com by michael.hale@gmail.com on 8 Jun 2013 at 3:56

GoogleCodeExporter commented 8 years ago
per attc, this is probably a better check, since seek to offset 0 is valid:

return 0 <= addr < self.fsize

Original comment by michael.hale@gmail.com on 8 Jun 2013 at 11:25

GoogleCodeExporter commented 8 years ago
This issue was closed by revision r3437.

Original comment by labaru...@gmail.com on 12 Jun 2013 at 5:25