It turns out that cloning native_templates was unnecessary or slow. F…

…ix and document why clearly.

volatility/framework/symbols/intermed.py

@@ -307,7 +307,8 @@ def _interdict_to_template(self, dictionary: typing.Dict[str, typing.Any]) -> in
             elif type_name == 'bitfield':
                 update = {'start_bit': dictionary['bit_position'], 'end_bit': dictionary['bit_length']}
                 update['base_type'] = self._interdict_to_template(dictionary['type'])
-            native_template = native_template.clone()
+            # We do *not* call native_template.clone(), since it slows everything down a lot
+            # We require that the native.get_type method always returns a newly constructed python object
             native_template.update_vol(**update)
             return native_template
 

volatility/framework/symbols/native.py

@@ -33,7 +33,8 @@ def types(self) -> typing.Iterable[str]:
     def get_type(self, type_name: str) -> interfaces.objects.Template:
         """Resolves a symbol name into an object template
 
-           symbol_space is used to resolve any subtype symbols if they don't exist in this list
+           This always construct a new python object, rather than using a cached value otherwise changes made later may
+           affect the cached copy.  Calling clone after every native type construction was extremely slow.
         """
         # NOTE: These need updating whenever the object init signatures change
         prefix = ""