Windows Events: recalculate the length of unicode strings returned every time (#18525)
recalculate the length of unicode strings returned every time
Costa Tsaousis committed
Sep 11, 2024 at 12:54 UTC
ba92581cef1491ae4c49779f583f303709cb83f0
1 file changed
+8
-7
src/collectors/windows-events.plugin/windows-events-query.c
+8
-7
@@ -129,14 +129,15 @@ static bool wevt_get_message_utf8(WEVT_LOG *log, EVT_HANDLE event_handle, TXT_UT
129
}
130
}
131
132
- // EvtFormatMessage pads it with zeros at the end
133
- while(size >= 2 && log->ops.unicode.data[size - 2] == 0)
134
- size--;
135
-
136
- log->ops.unicode.used = size;
132
+ // make sure it is null terminated
133
+ if(size <= log->ops.unicode.size)
134
+ log->ops.unicode.data[size - 1] = 0;
135
+ else
136
+ log->ops.unicode.data[log->ops.unicode.size - 1] = 0;
137
138
- internal_fatal(wcslen(log->ops.unicode.data) + 1 != (size_t)log->ops.unicode.used,
139
- "Wrong unicode string length!");
138
+ // unfortunately we have to calculate the length every time
139
+ // the size returned may not be the length of the unicode string
140
+ log->ops.unicode.used = wcslen(log->ops.unicode.data) + 1;
141
142
return wevt_str_unicode_to_utf8(dst, &log->ops.unicode);
143