[Win32utils-devel] Problem reading log with win32-eventlog - buffertoo small

[Daniel Berger]

Park Heesob wrote:
> Hi,
> ----- Original Message ----- 
> From: "Daniel Berger" <djberg96 at gmail.com>
> To: "win32utils-devel" <win32utils-devel at rubyforge.org>
> Sent: Sunday, May 18, 2008 4:38 AM
> Subject: [Win32utils-devel] Problem reading log with win32-eventlog - buffertoo small
> 
> 
>> Hi all,
>>
>> A user recently ran into an issue with win32-eventlog and the 
>> EventLog#read method when reading a saved log file. It seems that 
>> there's an issue.
>>
>> After some experimentation I found that the problem seems to be that the 
>> initial buffer to ReadEventLog() in line 558 is too small, so it tries a 
>> second call to ReadEventLog() with a larger buffer. The problem is that, 
>> after I added some error checking code there, the second attempt returns:
>>
>> "The data area passed to a system call is too small"
>>
>> What I can't figure out is why it's failing. The buffer is plenty big, 
>> and I even tried setting it to the max value (0x7ffff bytes), but I 
>> still get that error.
>>
>> Any ideas? I've attached the log file in question. The error happens 
>> right after log entry 136.
>>
> Modify #561-566 of eventlog.rb
> 
>             if GetLastError() == ERROR_INSUFFICIENT_BUFFER
>                buf = (0.chr * buf.size) + (0.chr * needed.unpack('L')[0])
>                unless ReadEventLog(@handle, flags, offset, buf, size, read, needed)
>                   raise Error, get_last_error
>                end
>             end
> to
>             if GetLastError() == ERROR_INSUFFICIENT_BUFFER
>                buf = (0.chr * buf.size) + (0.chr * needed.unpack('L')[0])
>                size = buf.size
>                unless ReadEventLog(@handle, flags, offset, buf, size, read, needed)
>                   raise Error, get_last_error
>                end
>             end
> 
> It is a very simple but  invisible bug :)

Oh, that was silly of me. Wow, that's been there a long time. I guess 
there aren't many log entries over 64k. :)

Many thanks,

Dan