add section address sanity check

Author: Abyss-W4tcher

volatility3/framework/symbols/linux/utilities/module_extract.py

@@ -10,12 +10,14 @@
     Dict,
 )
 
+import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules
 from volatility3 import framework
 from volatility3.framework import (
     interfaces,
     exceptions,
     symbols,
 )
+from volatility3.framework.configuration import requirements
 from volatility3.framework.constants import linux as linux_constants
 from volatility3.framework.symbols.linux import extensions
 
@@ -38,11 +40,21 @@
 class ModuleExtract(interfaces.configuration.VersionableInterface):
     """Extracts Linux kernel module structures into an analyzable ELF file"""
 
-    _version = (1, 0, 1)
+    _version = (1, 0, 2)
     _required_framework_version = (2, 25, 0)
 
     framework.require_interface_version(*_required_framework_version)
 
+    @classmethod
+    def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
+        return [
+            requirements.VersionRequirement(
+                name="linux_utilities_modules",
+                component=linux_utilities_modules.Modules,
+                version=(3, 0, 2),
+            ),
+        ]
+
     @classmethod
     def _find_section(
         cls, section_lookups: List[Tuple[str, int, int, int]], sym_address: int
@@ -237,17 +249,32 @@ def _parse_sections(
         The data of .strtab is read directly off the module structure and not its section
         as the section from the original module has no meaning after loading as the kernel does not reference it.
         """
+        kernel = context.modules[vmlinux_name]
+        kernel_layer = context.layers[kernel.layer_name]
+        modules_addr_min, modules_addr_max = (
+            linux_utilities_modules.Modules.get_modules_memory_boundaries(
+                context, vmlinux_name
+            )
+        )
+        modules_addr_min &= kernel_layer.address_mask
+        modules_addr_max &= kernel_layer.address_mask
+
         original_sections = {}
         for index, section in enumerate(module.get_sections()):
+            # Extra sanity check, to prevent OOM on heavily smeared samples at line
+            # "size = next_address - address"
+            if (
+                not modules_addr_min
+                <= kernel_layer.address_mask & section.address
+                < modules_addr_max
+            ):
+                continue
             name = section.get_name()
             original_sections[section.address] = name
 
         if not original_sections:
             return None
 
-        kernel = context.modules[vmlinux_name]
-        kernel_layer = context.layers[kernel.layer_name]
-
         if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name):
             sym_type = "Elf64_Sym"
             elf_hdr_type = "Elf64_Ehdr"