From 1fef570022eb0ae13924ed321e5c09a24fe72563 Mon Sep 17 00:00:00 2001
From: Abyss Watcher <abyss-w4tcher@proton.me>
Date: Sun, 22 Dec 2024 14:15:45 +0100
Subject: [PATCH] restrict output to PNG, unify file handling

---
 .../framework/plugins/linux/graphics/fbdev.py | 28 +++++++++----------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py
index 28cae8000..e82827944 100644
--- a/volatility3/framework/plugins/linux/graphics/fbdev.py
+++ b/volatility3/framework/plugins/linux/graphics/fbdev.py
@@ -160,15 +160,13 @@ def dump_fb(
         kernel_name: str,
         open_method: Type[interfaces.plugins.FileHandlerInterface],
         fb: Framebuffer,
-        convert_to_image: bool,
-        image_format: str = "PNG",
+        convert_to_png_image: bool,
     ) -> str:
-        """Dump a Framebuffer raw buffer to disk.
+        """Dump a Framebuffer buffer to disk.
 
         Args:
             fb: the relevant Framebuffer object
             convert_to_image: a boolean specifying if the buffer should be converted to an image
-            image_format: the target PIL image format (defaults to PNG)
 
         Returns:
             The filename of the dumped buffer.
@@ -176,19 +174,19 @@ def dump_fb(
         kernel = context.modules[kernel_name]
         kernel_layer = context.layers[kernel.layer_name]
         base_filename = f"{fb.id}_{fb.xres_virtual}x{fb.yres_virtual}_{fb.bpp}bpp"
-        if convert_to_image:
-            image = cls.convert_fb_raw_buffer_to_image(context, kernel_name, fb)
-            output = io.BytesIO()
-            image.save(output, image_format)
-            file_handle = open_method(f"{base_filename}.{image_format.lower()}")
-            file_handle.write(output.getvalue())
+        if convert_to_png_image:
+            image_object = cls.convert_fb_raw_buffer_to_image(context, kernel_name, fb)
+            raw_io_output = io.BytesIO()
+            image_object.save(raw_io_output, "PNG")
+            final_fb_buffer = raw_io_output.getvalue()
+            filename = f"{base_filename}.png"
         else:
-            raw_pixels = kernel_layer.read(fb.fb_info.screen_base, fb.size)
-            file_handle = open_method(f"{base_filename}.raw")
-            file_handle.write(raw_pixels)
+            final_fb_buffer = kernel_layer.read(fb.fb_info.screen_base, fb.size)
+            filename = f"{base_filename}.raw"
 
-        file_handle.close()
-        return file_handle.preferred_filename
+        with open_method(filename) as f:
+            f.write(final_fb_buffer)
+            return f.preferred_filename
 
     @classmethod
     def parse_fb_info(