Skip to content

Commit

Permalink
Merge pull request #1222 from gcmoreira/renderers_time_conversion_fixes
Browse files Browse the repository at this point in the history
Renderers time conversion fixes
  • Loading branch information
ikelos authored Jul 30, 2024
2 parents af7466b + efc48d5 commit 189f872
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 6 deletions.
4 changes: 3 additions & 1 deletion volatility3/framework/plugins/timeliner.py
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,9 @@ def _sort_function(self, item):
data = item[1]

def sortable(timestamp):
max_date = datetime.datetime(day=1, month=12, year=datetime.MAXYEAR)
max_date = datetime.datetime(
day=1, month=12, year=datetime.MAXYEAR, tzinfo=datetime.timezone.utc
)
if isinstance(timestamp, interfaces.renderers.BaseAbsentValue):
return max_date
return timestamp
Expand Down
14 changes: 9 additions & 5 deletions volatility3/framework/renderers/conversion.py
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,11 @@ def wintime_to_datetime(
return renderers.NotApplicableValue()
unix_time = unix_time - 11644473600
try:
return datetime.datetime.utcfromtimestamp(unix_time)
# Windows sometimes throws OSErrors rather than ValueErrors when it can't convert a value
except (ValueError, OSError):
return datetime.datetime.fromtimestamp(unix_time, datetime.timezone.utc)
# Windows sometimes throws OSErrors rather than ValueError/OverflowError when it can't convert a value
# Since Python 3.3, this should raise OverflowError instead of ValueError. However, it was observed
# that even in Python 3.7.17, ValueError is still being raised.
except (ValueError, OverflowError, OSError):
return renderers.UnparsableValue()


Expand All @@ -33,8 +35,10 @@ def unixtime_to_datetime(
)

if unixtime > 0:
with contextlib.suppress(ValueError):
ret = datetime.datetime.utcfromtimestamp(unixtime)
# Since Python 3.3, this should raise OverflowError instead of ValueError. However, it was observed
# that even in Python 3.7.17, ValueError is still being raised. OSError is also raised on Linux
with contextlib.suppress(ValueError, OverflowError, OSError):
ret = datetime.datetime.fromtimestamp(unixtime, datetime.timezone.utc)

return ret

Expand Down

0 comments on commit 189f872

Please sign in to comment.