win32utils devel - May 2008 - Problem reading log with win32-eventlog - buffer too small

Hi all,

A user recently ran into an issue with win32-eventlog and the 
EventLog#read method when reading a saved log file. It seems that 
there''s an issue.

After some experimentation I found that the problem seems to be that the 
initial buffer to ReadEventLog() in line 558 is too small, so it tries a 
second call to ReadEventLog() with a larger buffer. The problem is that, 
after I added some error checking code there, the second attempt returns:

"The data area passed to a system call is too small"

What I can''t figure out is why it''s failing. The buffer is
plenty big,
and I even tried setting it to the max value (0x7ffff bytes), but I 
still get that error.

Any ideas? I''ve attached the log file in question. The error happens 
right after log entry 136.

BTW, I''ve added some error handling in CVS, so please checkout the 
latest code.

Regards,

Dan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: AppEvent.evt
Type: application/octet-stream
Size: 373748 bytes
Desc: not available
URL:
<http://rubyforge.org/pipermail/win32utils-devel/attachments/20080517/82ff1deb/attachment-0001.obj>

Hi,
----- Original Message ----- 
From: "Daniel Berger" <djberg96 at gmail.com>
To: "win32utils-devel" <win32utils-devel at rubyforge.org>
Sent: Sunday, May 18, 2008 4:38 AM
Subject: [Win32utils-devel] Problem reading log with win32-eventlog - buffertoo
small

> Hi all,
> 
> A user recently ran into an issue with win32-eventlog and the 
> EventLog#read method when reading a saved log file. It seems that 
> there''s an issue.
> 
> After some experimentation I found that the problem seems to be that the 
> initial buffer to ReadEventLog() in line 558 is too small, so it tries a 
> second call to ReadEventLog() with a larger buffer. The problem is that, 
> after I added some error checking code there, the second attempt returns:
> 
> "The data area passed to a system call is too small"
> 
> What I can''t figure out is why it''s failing. The buffer
is plenty big,
> and I even tried setting it to the max value (0x7ffff bytes), but I 
> still get that error.
> 
> Any ideas? I''ve attached the log file in question. The error
happens
> right after log entry 136.
> 
Modify #561-566 of eventlog.rb

            if GetLastError() == ERROR_INSUFFICIENT_BUFFER
               buf = (0.chr * buf.size) + (0.chr *
needed.unpack(''L'')[0])
               unless ReadEventLog(@handle, flags, offset, buf, size, read,
needed)
                  raise Error, get_last_error
               end
            end
to
            if GetLastError() == ERROR_INSUFFICIENT_BUFFER
               buf = (0.chr * buf.size) + (0.chr *
needed.unpack(''L'')[0])
               size = buf.size
               unless ReadEventLog(@handle, flags, offset, buf, size, read,
needed)
                  raise Error, get_last_error
               end
            end

It is a very simple but  invisible bug :)

Regards,

Park Heesob

Park Heesob wrote:
> Hi,
> ----- Original Message ----- 
> From: "Daniel Berger" <djberg96 at gmail.com>
> To: "win32utils-devel" <win32utils-devel at rubyforge.org>
> Sent: Sunday, May 18, 2008 4:38 AM
> Subject: [Win32utils-devel] Problem reading log with win32-eventlog -
buffertoo small
> 
> 
>> Hi all,
>>
>> A user recently ran into an issue with win32-eventlog and the 
>> EventLog#read method when reading a saved log file. It seems that 
>> there''s an issue.
>>
>> After some experimentation I found that the problem seems to be that
the
>> initial buffer to ReadEventLog() in line 558 is too small, so it tries
a
>> second call to ReadEventLog() with a larger buffer. The problem is
that,
>> after I added some error checking code there, the second attempt
returns:
>>
>> "The data area passed to a system call is too small"
>>
>> What I can''t figure out is why it''s failing. The
buffer is plenty big,
>> and I even tried setting it to the max value (0x7ffff bytes), but I 
>> still get that error.
>>
>> Any ideas? I''ve attached the log file in question. The error
happens
>> right after log entry 136.
>>
> Modify #561-566 of eventlog.rb
> 
>             if GetLastError() == ERROR_INSUFFICIENT_BUFFER
>                buf = (0.chr * buf.size) + (0.chr *
needed.unpack(''L'')[0])
>                unless ReadEventLog(@handle, flags, offset, buf, size, read,
needed)
>                   raise Error, get_last_error
>                end
>             end
> to
>             if GetLastError() == ERROR_INSUFFICIENT_BUFFER
>                buf = (0.chr * buf.size) + (0.chr *
needed.unpack(''L'')[0])
>                size = buf.size
>                unless ReadEventLog(@handle, flags, offset, buf, size, read,
needed)
>                   raise Error, get_last_error
>                end
>             end
> 
> It is a very simple but  invisible bug :)
Oh, that was silly of me. Wow, that''s been there a long time. I guess 
there aren''t many log entries over 64k. :)

Many thanks,

Dan