[Win32utils-devel] Problem reading log with win32-eventlog - buffertoo small

Park Heesob phasis at gmail.com
Sat May 17 22:26:59 EDT 2008


Hi,
----- Original Message ----- 
From: "Daniel Berger" <djberg96 at gmail.com>
To: "win32utils-devel" <win32utils-devel at rubyforge.org>
Sent: Sunday, May 18, 2008 4:38 AM
Subject: [Win32utils-devel] Problem reading log with win32-eventlog - buffertoo small


> Hi all,
> 
> A user recently ran into an issue with win32-eventlog and the 
> EventLog#read method when reading a saved log file. It seems that 
> there's an issue.
> 
> After some experimentation I found that the problem seems to be that the 
> initial buffer to ReadEventLog() in line 558 is too small, so it tries a 
> second call to ReadEventLog() with a larger buffer. The problem is that, 
> after I added some error checking code there, the second attempt returns:
> 
> "The data area passed to a system call is too small"
> 
> What I can't figure out is why it's failing. The buffer is plenty big, 
> and I even tried setting it to the max value (0x7ffff bytes), but I 
> still get that error.
> 
> Any ideas? I've attached the log file in question. The error happens 
> right after log entry 136.
> 
Modify #561-566 of eventlog.rb

            if GetLastError() == ERROR_INSUFFICIENT_BUFFER
               buf = (0.chr * buf.size) + (0.chr * needed.unpack('L')[0])
               unless ReadEventLog(@handle, flags, offset, buf, size, read, needed)
                  raise Error, get_last_error
               end
            end
to
            if GetLastError() == ERROR_INSUFFICIENT_BUFFER
               buf = (0.chr * buf.size) + (0.chr * needed.unpack('L')[0])
               size = buf.size
               unless ReadEventLog(@handle, flags, offset, buf, size, read, needed)
                  raise Error, get_last_error
               end
            end

It is a very simple but  invisible bug :)

Regards,

Park Heesob


More information about the win32utils-devel mailing list