winevt_c 0.11.4 → 0.11.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4231aa8b328c8b400c7a1948fa6a05798cc404146e744b93654321e6c8df2ced
-  data.tar.gz: ebccd019f7c62066840faf7df5b11b27ee8d249816f7a13a3e449f3ff852ccd4
+  metadata.gz: 8cae317f8e53bccce324f256e88df86042e221489c05384728ceb44acf40929d
+  data.tar.gz: a08a75d868d7ff8f186077f0dbaafc3fd82ef6a89f8ebd92c8deeaab996fa257
 SHA512:
-  metadata.gz: b6189e52e89878adcfeb09a1e100b50d5da9a053b16626582665d474c407dce402b05beea0dcc7671d27f2396dd993eec7ccce3ffe4a565f27de726fefee623f
-  data.tar.gz: a37df6779a02e6ae99bfd5557b3cef79429c908f3201c8f47794ceb479933f2dbf0c4745ab4cc005abedf9ae27eb4081234ec3a4ccedd6438be618c9f57426fc
+  metadata.gz: 3ca5a2836e88d7e1815a04d4f3698c4526d64643035833f7ce22acc220de23d7c5f26222f398284da02f47d55b36fd0f262124a2c38cfe8daff057813b919374
+  data.tar.gz: 426256cdc15034f4acfadcac742f854467b8eb574efe1f15e6cb2b8e8b6ac8d4b3fc70644953d4382b55fd7378f98b88bd51628d957a7200973fb24ac400f5a3

data/.github/workflows/test.yml

@@ -11,20 +11,25 @@ jobs:
     uses: ruby/actions/.github/workflows/ruby_versions.yml@master
     with:
       engine: cruby
-      min_version: 3.1
+      min_version: 3.2
   build:
     needs: ruby-versions
-    runs-on: 'windows-latest'
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
+        os: ['windows-latest', 'windows-11-arm']
         ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
         exclude:
           - ruby: head
-    name: Ruby ${{ matrix.ruby }}
+          - os: 'windows-11-arm'
+            ruby: '3.3'
+          - os: 'windows-11-arm'
+            ruby: '3.2'
+    name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-    - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ matrix.ruby }}
     - name: Run tests

data/README.md

@@ -6,7 +6,7 @@
 
 * Windows Vista/Windows Server 2008 or later.
 * gcc and g++ from MSYS2 for building C/C++ extension.
-* Ruby 2.4 or later with MSYS2.
+* Ruby 3.2 or later with MSYS2.
 
 ## Installation
 

data/ext/winevt/extconf.rb

@@ -14,9 +14,6 @@ have_library("wevtapi")
 have_func("EvtQuery", "winevt.h")
 have_library("advapi32")
 have_library("ole32")
-if have_macro("RB_ALLOCV")
-  $CFLAGS << " -DHAVE_RB_ALLOCV=1 "
-end
 
 $LDFLAGS << " -lwevtapi -ladvapi32 -lole32"
 $CFLAGS << " -Wall -std=c99 -fPIC -fms-extensions "

data/ext/winevt/winevt_bookmark.c

@@ -17,7 +17,7 @@
  *
  *  puts @bookmark.render
  */
-/* clang-format pn */
+/* clang-format on */
 
 VALUE rb_cBookmark;
 
@@ -54,9 +54,9 @@ rb_winevt_bookmark_alloc(VALUE klass)
 }
 
 /*
- * Initalize Bookmark class. Receive XML string or nil.
+ * Initialize Bookmark class. Receive XML string or nil.
  *
- * @overload initailize(options={})
+ * @overload initialize(options={})
  *   @option options [String] XML rendered Bookmark string.
  * @return [Bookmark]
  *
@@ -109,12 +109,16 @@ rb_winevt_bookmark_update(VALUE self, VALUE event)
   struct WinevtQuery* winevtQuery;
   struct WinevtBookmark* winevtBookmark;
 
+  if (!rb_obj_is_kind_of(event, rb_cQuery)) {
+    rb_raise(rb_eArgError, "Expected a Query instance");
+  }
+
   winevtQuery = EventQuery(event);
 
   TypedData_Get_Struct(
     self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
 
-  for (int i = 0; i < winevtQuery->count; i++) {
+  for (ULONG i = 0; i < winevtQuery->count; i++) {
     if (!EvtUpdateBookmark(winevtBookmark->bookmark, winevtQuery->hEvents[i]))
       return Qfalse;
   }

data/ext/winevt/winevt_c.h

@@ -16,11 +16,6 @@
 #endif /* WIN32_WINNT */
 #define _WIN32_WINNT MINIMUM_WINDOWS_VERSION
 
-#if !defined(HAVE_RB_ALLOCV)
-#define ALLOCV     RB_ALLOCV
-#define ALLOCV_N   RB_ALLOCV_N
-#endif
-
 #include <time.h>
 #include <winevt.h>
 #define EventQuery(object) ((struct WinevtQuery*)DATA_PTR(object))
@@ -52,7 +47,8 @@ EVT_HANDLE connect_to_remote(LPWSTR computerName, LPWSTR domain,
                              LPWSTR username, LPWSTR password,
                              EVT_RPC_LOGIN_FLAGS flags,
                              DWORD *error_code);
-WCHAR* get_description(EVT_HANDLE handle, LANGID langID, EVT_HANDLE hRemote);
+WCHAR* get_description(EVT_HANDLE handle, LANGID langID, EVT_HANDLE hRemote,
+                       BOOL* resolved);
 VALUE get_values(EVT_HANDLE handle);
 VALUE render_system_event(EVT_HANDLE handle, BOOL preserve_qualifiers, BOOL preserveSID);
 LocaleInfo* get_locale_info_from_rb_str(VALUE rb_locale_str);
@@ -112,6 +108,7 @@ struct WinevtQuery
   BOOL preserveSID;
   LocaleInfo *localeInfo;
   EVT_HANDLE remoteHandle;
+  ULONGLONG unresolvedMessageCount;
 };
 
 #define SUBSCRIBE_ARRAY_SIZE 10
@@ -134,6 +131,7 @@ struct WinevtSubscribe
   BOOL preserveSID;
   LocaleInfo* localeInfo;
   EVT_HANDLE remoteHandle;
+  ULONGLONG unresolvedMessageCount;
 };
 
 void Init_winevt_query(VALUE rb_cEventLog);

data/ext/winevt/winevt_channel.c

@@ -56,7 +56,7 @@ rb_winevt_channel_alloc(VALUE klass)
 }
 
 /*
- * Initalize Channel class.
+ * Initialize Channel class.
  *
  * @return [Channel]
  *
@@ -177,6 +177,14 @@ DWORD check_subscribable_with_channel_config_type(int Id, PEVT_VARIANT pProperty
 #undef EVENT_DEBUG_TYPE
 #undef EVENT_ANALYTICAL_TYPE
 
+// A per-channel failure skips that channel, but memory exhaustion is not a
+// property of any channel and would silently shorten the whole list.
+static BOOL
+is_resource_exhaustion(DWORD status)
+{
+  return status == ERROR_OUTOFMEMORY || status == ERROR_NOT_ENOUGH_MEMORY;
+}
+
 /*
  * Enumerate Windows EventLog channels
  *
@@ -245,34 +253,26 @@ rb_winevt_channel_each(VALUE self)
     }
     hChannelConfig = EvtOpenChannelConfig(NULL, buffer, 0);
     if (NULL == hChannelConfig) {
-      _snprintf_s(errBuf,
-                  _countof(errBuf),
-                  _TRUNCATE,
-                  "EvtOpenChannelConfig failed with %lu.\n",
-                  GetLastError());
-
-      EvtClose(winevtChannel->channels);
-      winevtChannel->channels = NULL;
+      status = GetLastError();
 
       free(buffer);
       buffer = NULL;
       bufferSize = 0;
 
-      rb_raise(rb_eRuntimeError, errBuf);
-    }
-
-    status = is_subscribable_channel_p(hChannelConfig, winevtChannel->force_enumerate);
-    EvtClose(hChannelConfig);
+      if (is_resource_exhaustion(status)) {
+        EvtClose(winevtChannel->channels);
+        winevtChannel->channels = NULL;
 
-    if (status == ERROR_INVALID_DATA) {
-      free(buffer);
-      buffer = NULL;
-      bufferSize = 0;
+        rb_raise(rb_eRuntimeError, "EvtOpenChannelConfig failed with %lu\n", status);
+      }
 
       continue;
     }
 
-    if (status == ERROR_OUTOFMEMORY) {
+    status = is_subscribable_channel_p(hChannelConfig, winevtChannel->force_enumerate);
+    EvtClose(hChannelConfig);
+
+    if (is_resource_exhaustion(status)) {
       EvtClose(winevtChannel->channels);
       winevtChannel->channels = NULL;
 
@@ -280,16 +280,18 @@ rb_winevt_channel_each(VALUE self)
       buffer = NULL;
       bufferSize = 0;
 
-      rb_raise(rb_eRuntimeError, "realloc failed\n");
-    } else if (status != ERROR_SUCCESS) {
-      EvtClose(winevtChannel->channels);
-      winevtChannel->channels = NULL;
+      rb_raise(rb_eRuntimeError, "Failed to read channel configuration with %lu\n", status);
+    }
 
+    // Not fatal: Security's configuration cannot be read without elevation, and
+    // it is the third channel EvtOpenChannelEnum returns, so raising here
+    // truncated the whole enumeration to two channels.
+    if (status != ERROR_SUCCESS) {
       free(buffer);
       buffer = NULL;
       bufferSize = 0;
 
-      rb_raise(rb_eRuntimeError, "is_subscribe_channel_p is failed with %ld\n", status);
+      continue;
     }
 
     utf8str = wstr_to_rb_str(CP_UTF8, buffer, -1);

data/ext/winevt/winevt_locale.c

@@ -49,7 +49,7 @@ rb_winevt_locale_alloc(VALUE klass)
 }
 
 /*
- * Initalize Locale class.
+ * Initialize Locale class.
  *
  * @return [Locale]
  *

data/ext/winevt/winevt_query.c

@@ -1,5 +1,7 @@
 #include <winevt_c.h>
 
+#include <ruby/thread.h>
+
 /* clang-format off */
 /*
  * Document-class: Winevt::EventLog::Query
@@ -39,7 +41,7 @@ close_handles(struct WinevtQuery* winevtQuery)
     winevtQuery->query = NULL;
   }
 
-  for (int i = 0; i < winevtQuery->count; i++) {
+  for (ULONG i = 0; i < winevtQuery->count; i++) {
     if (winevtQuery->hEvents[i]) {
       EvtClose(winevtQuery->hEvents[i]);
       winevtQuery->hEvents[i] = NULL;
@@ -71,8 +73,35 @@ rb_winevt_query_alloc(VALUE klass)
   return obj;
 }
 
+struct query_args
+{
+  EVT_HANDLE session;
+  LPCWSTR channel;
+  LPCWSTR xpath;
+  DWORD flags;
+  EVT_HANDLE handle;
+  DWORD error_code;
+};
+
+/*
+ * GetLastError is read here rather than by the caller: it belongs to the thread
+ * that made the call and does not survive re-acquiring the GVL.
+ */
+static void*
+query_without_gvl(void* ptr)
+{
+  struct query_args* args = (struct query_args*)ptr;
+
+  args->handle = EvtQuery(args->session, args->channel, args->xpath, args->flags);
+  if (!args->handle) {
+    args->error_code = GetLastError();
+  }
+
+  return NULL;
+}
+
 /*
- * Initalize Query class.
+ * Initialize Query class.
  *
  * @overload initialize(channel, xpath, session=nil)
  *   @param channel [String] Querying EventLog channel.
@@ -141,10 +170,30 @@ rb_winevt_query_initialize(VALUE argc, VALUE *argv, VALUE self)
 
   TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
 
-  winevtQuery->query = EvtQuery(
-    hRemoteHandle, evtChannel, evtXPath, flags);
-  err = GetLastError();
-  if (err != ERROR_SUCCESS) {
+  if (hRemoteHandle != NULL) {
+    struct query_args args;
+
+    args.session = hRemoteHandle;
+    args.channel = evtChannel;
+    args.xpath = evtXPath;
+    args.flags = flags;
+    args.handle = NULL;
+    args.error_code = ERROR_SUCCESS;
+
+    // EvtOpenSession only builds the session object; this is the first call
+    // that reaches the remote machine, so it is the one that can stall.
+    rb_thread_call_without_gvl(query_without_gvl, &args, NULL, NULL);
+
+    winevtQuery->query = args.handle;
+    err = args.error_code;
+  } else {
+    winevtQuery->query = EvtQuery(hRemoteHandle, evtChannel, evtXPath, flags);
+    if (winevtQuery->query == NULL) {
+      err = GetLastError();
+    }
+  }
+
+  if (winevtQuery->query == NULL) {
     if (hRemoteHandle != NULL) {
       EvtClose(hRemoteHandle);
     }
@@ -160,6 +209,7 @@ rb_winevt_query_initialize(VALUE argc, VALUE *argv, VALUE self)
   winevtQuery->localeInfo = &default_locale;
   winevtQuery->remoteHandle = hRemoteHandle;
   winevtQuery->preserveSID = TRUE;
+  winevtQuery->unresolvedMessageCount = 0;
 
   ALLOCV_END(wchannelBuf);
   ALLOCV_END(wpathBuf);
@@ -260,8 +310,17 @@ rb_winevt_query_next(VALUE self)
   }
 
   if (status == ERROR_SUCCESS) {
+    // #each frees each batch in its ensure block; this covers calling #next
+    // directly in a loop.
+    for (ULONG i = 0; i < winevtQuery->count; i++) {
+      if (winevtQuery->hEvents[i]) {
+        EvtClose(winevtQuery->hEvents[i]);
+        winevtQuery->hEvents[i] = NULL;
+      }
+    }
+
     winevtQuery->count = count;
-    for (int i = 0; i < count; i++) {
+    for (ULONG i = 0; i < count; i++) {
       winevtQuery->hEvents[i] = hEvents[i];
     }
 
@@ -287,12 +346,19 @@ rb_winevt_query_render(VALUE self, EVT_HANDLE event)
 }
 
 static VALUE
-rb_winevt_query_message(EVT_HANDLE event, LocaleInfo* localeInfo, EVT_HANDLE hRemote)
+rb_winevt_query_message(struct WinevtQuery* winevtQuery, EVT_HANDLE event)
 {
   WCHAR* wResult;
   VALUE utf8str;
-
-  wResult = get_description(event, localeInfo->langID, hRemote);
+  BOOL resolved = TRUE;
+
+  wResult = get_description(event,
+                            winevtQuery->localeInfo->langID,
+                            winevtQuery->remoteHandle,
+                            &resolved);
+  if (!resolved) {
+    winevtQuery->unresolvedMessageCount++;
+  }
   utf8str = wstr_to_rb_str(CP_UTF8, wResult, -1);
   free(wResult);
 
@@ -382,7 +448,7 @@ rb_winevt_query_close_handle(VALUE self)
 
   TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
 
-  for (int i = 0; i < winevtQuery->count; i++) {
+  for (ULONG i = 0; i < winevtQuery->count; i++) {
     if (winevtQuery->hEvents[i] != NULL) {
       EvtClose(winevtQuery->hEvents[i]);
       winevtQuery->hEvents[i] = NULL;
@@ -401,11 +467,10 @@ rb_winevt_query_each_yield(VALUE self)
 
   TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
 
-  for (int i = 0; i < winevtQuery->count; i++) {
+  for (ULONG i = 0; i < winevtQuery->count; i++) {
     rb_yield_values(3,
                     rb_winevt_query_render(self, winevtQuery->hEvents[i]),
-                    rb_winevt_query_message(winevtQuery->hEvents[i], winevtQuery->localeInfo,
-                                            winevtQuery->remoteHandle),
+                    rb_winevt_query_message(winevtQuery, winevtQuery->hEvents[i]),
                     rb_winevt_query_string_inserts(winevtQuery->hEvents[i]));
   }
   return Qnil;
@@ -577,6 +642,27 @@ rb_winevt_query_preserve_sid_p(VALUE self)
   return winevtQuery->preserveSID ? Qtrue : Qfalse;
 }
 
+/*
+ * This method returns how many events had no description message. Message
+ * resolution fails for reasons outside the caller's control (a provider whose
+ * message DLL is gone, a locale without resources), and #each degrades to an
+ * empty message instead of aborting the enumeration. The counter increases
+ * monotonically, so callers can poll it and take the difference to tell a few
+ * unresolvable events apart from a channel that resolves nothing.
+ *
+ * @return [Integer]
+ */
+static VALUE
+rb_winevt_query_get_unresolved_message_count(VALUE self)
+{
+  struct WinevtQuery* winevtQuery;
+
+  TypedData_Get_Struct(
+    self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
+
+  return ULL2NUM(winevtQuery->unresolvedMessageCount);
+}
+
 /*
  * This method cancels channel query.
  *
@@ -733,6 +819,7 @@ Init_winevt_query(VALUE rb_cEventLog)
    * @since 0.11.0
    */
   rb_define_method(rb_cQuery, "preserve_sid=", rb_winevt_query_set_preserve_sid, 1);
+  rb_define_method(rb_cQuery, "unresolved_message_count", rb_winevt_query_get_unresolved_message_count, 0);
   /*
    * @since 0.9.1
    */

data/ext/winevt/winevt_session.c

@@ -14,7 +14,7 @@
  *  @session.domain = "<EXAMPLEGROUP>"
  *  @session.username = "<username>"
  *  @session.password = "<password>"
- *  # Then pass @session veriable into Winevt::EventLog::Query or
+ *  # Then pass @session variable into Winevt::EventLog::Query or
  *  # Winevt::EventLog::Subscribe#subscribe
  *  @query = Winevt::EventLog::Query.new(
  *    "Application",
@@ -60,8 +60,11 @@ session_free(void* ptr)
     free(winevtSession->domain);
   if (winevtSession->username)
     free(winevtSession->username);
-  if (winevtSession->password)
+  if (winevtSession->password) {
+    SecureZeroMemory(winevtSession->password,
+                     (wcslen(winevtSession->password) + 1) * sizeof(WCHAR));
     free(winevtSession->password);
+  }
 
   xfree(ptr);
 }
@@ -77,7 +80,7 @@ rb_winevt_session_alloc(VALUE klass)
 }
 
 /*
- * Initalize Session class.
+ * Initialize Session class.
  *
  * @overload initialize(server, domain=nil, username=nil, password=nil, flags=Winevt::EventLog::Session::RpcLoginFlag::AuthDefault)
  *   @param server [String] Server ip address or fqdn.
@@ -151,6 +154,8 @@ rb_winevt_session_set_server(VALUE self, VALUE rb_server)
                       RSTRING_PTR(rb_server), RSTRING_LEN(rb_server),
                       wServer, len);
   wServer[len] = L'\0';
+  if (winevtSession->server)
+    free(winevtSession->server);
   winevtSession->server = _wcsdup(wServer);
 
   ALLOCV_END(vserverBuf);
@@ -204,6 +209,8 @@ rb_winevt_session_set_domain(VALUE self, VALUE rb_domain)
                       wDomain, len);
   wDomain[len] = L'\0';
 
+  if (winevtSession->domain)
+    free(winevtSession->domain);
   winevtSession->domain = _wcsdup(wDomain);
 
   ALLOCV_END(vdomainBuf);
@@ -257,6 +264,8 @@ rb_winevt_session_set_username(VALUE self, VALUE rb_username)
                       wUsername, len);
   wUsername[len] = L'\0';
 
+  if (winevtSession->username)
+    free(winevtSession->username);
   winevtSession->username = _wcsdup(wUsername);
 
   ALLOCV_END(vusernameBuf);
@@ -310,6 +319,11 @@ rb_winevt_session_set_password(VALUE self, VALUE rb_password)
                       wPassword, len);
   wPassword[len] = L'\0';
 
+  if (winevtSession->password) {
+    SecureZeroMemory(winevtSession->password,
+                     (wcslen(winevtSession->password) + 1) * sizeof(WCHAR));
+    free(winevtSession->password);
+  }
   winevtSession->password = _wcsdup(wPassword);
 
   ALLOCV_END(vpasswordBuf);
@@ -408,7 +422,7 @@ Init_winevt_session(VALUE rb_cEventLog)
    */
   rb_define_const(rb_cRpcLoginFlag, "AuthDefault", LONG2NUM(EvtRpcLoginAuthDefault));
   /*
-   * EVT_RPC_LOGIN_FLAGS enumeration: EvtRpcLoginAuthNegociate
+   * EVT_RPC_LOGIN_FLAGS enumeration: EvtRpcLoginAuthNegotiate
    * @see https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_rpc_login_flags
    */
   rb_define_const(rb_cRpcLoginFlag, "AuthNegociate", LONG2NUM(EvtRpcLoginAuthNegotiate));

data/ext/winevt/winevt_subscribe.c

@@ -56,7 +56,7 @@ close_handles(struct WinevtSubscribe* winevtSubscribe)
     winevtSubscribe->bookmark = NULL;
   }
 
-  for (int i = 0; i < winevtSubscribe->count; i++) {
+  for (DWORD i = 0; i < winevtSubscribe->count; i++) {
     if (winevtSubscribe->hEvents[i]) {
       EvtClose(winevtSubscribe->hEvents[i]);
       winevtSubscribe->hEvents[i] = NULL;
@@ -90,7 +90,7 @@ rb_winevt_subscribe_alloc(VALUE klass)
 }
 
 /*
- * Initalize Subscribe class.
+ * Initialize Subscribe class.
  *
  * @return [Subscribe]
  *
@@ -111,6 +111,7 @@ rb_winevt_subscribe_initialize(VALUE self)
   winevtSubscribe->preserveQualifiers = FALSE;
   winevtSubscribe->localeInfo = &default_locale;
   winevtSubscribe->preserveSID = TRUE;
+  winevtSubscribe->unresolvedMessageCount = 0;
 
   return Qnil;
 }
@@ -175,8 +176,6 @@ rb_winevt_subscribe_subscribe(int argc, VALUE* argv, VALUE self)
   struct WinevtSession* winevtSession;
   struct WinevtSubscribe* winevtSubscribe;
 
-  hSignalEvent = CreateEvent(NULL, TRUE, TRUE, NULL);
-
   TypedData_Get_Struct(
     self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
 
@@ -239,6 +238,7 @@ rb_winevt_subscribe_subscribe(int argc, VALUE* argv, VALUE self)
     flags |= EvtSubscribeToFutureEvents;
   }
 
+  hSignalEvent = CreateEvent(NULL, TRUE, TRUE, NULL);
   hSubscription =
     EvtSubscribe(hRemoteHandle, hSignalEvent, path, query, hBookmark, NULL, NULL, flags);
   if (!hSubscription) {
@@ -263,22 +263,13 @@ rb_winevt_subscribe_subscribe(int argc, VALUE* argv, VALUE self)
     }
   }
 
-  if (winevtSubscribe->subscription != NULL) {
-    // should be disgarded the old event subscription handle.
-    EvtClose(winevtSubscribe->subscription);
-  }
 
   ALLOCV_END(wpathBuf);
   ALLOCV_END(wqueryBuf);
 
-  winevtSubscribe->signalEvent = hSignalEvent;
-  winevtSubscribe->subscription = hSubscription;
-  winevtSubscribe->remoteHandle = hRemoteHandle;
-  if (hBookmark) {
-    winevtSubscribe->bookmark = hBookmark;
-  } else {
-    winevtSubscribe->bookmark = EvtCreateBookmark(NULL);
-    if (winevtSubscribe->bookmark == NULL) {
+  if (!hBookmark) {
+    hBookmark = EvtCreateBookmark(NULL);
+    if (hBookmark == NULL) {
       status = GetLastError();
       if (hSubscription != NULL) {
         EvtClose(hSubscription);
@@ -290,6 +281,20 @@ rb_winevt_subscribe_subscribe(int argc, VALUE* argv, VALUE self)
     }
   }
 
+  if (winevtSubscribe->subscription) {
+      EvtClose(winevtSubscribe->subscription);
+  }
+  if (winevtSubscribe->signalEvent) {
+      CloseHandle(winevtSubscribe->signalEvent);
+  }
+  if (winevtSubscribe->bookmark) {
+      EvtClose(winevtSubscribe->bookmark);
+  }
+  winevtSubscribe->signalEvent = hSignalEvent;
+  winevtSubscribe->subscription = hSubscription;
+  winevtSubscribe->remoteHandle = hRemoteHandle;
+  winevtSubscribe->bookmark = hBookmark;
+
   return Qtrue;
 }
 
@@ -298,7 +303,7 @@ is_rate_limit_exceeded(struct WinevtSubscribe* winevtSubscribe)
 {
   time_t now;
 
-  if (winevtSubscribe->rateLimit == SUBSCRIBE_RATE_INFINITE)
+  if (winevtSubscribe->rateLimit == (DWORD)SUBSCRIBE_RATE_INFINITE)
     return FALSE;
 
   time(&now);
@@ -319,7 +324,7 @@ update_to_reflect_rate_limit_state(struct WinevtSubscribe* winevtSubscribe, ULON
 {
   time_t lastTime = 0;
 
-  if (winevtSubscribe->rateLimit == SUBSCRIBE_RATE_INFINITE)
+  if (winevtSubscribe->rateLimit == (DWORD)SUBSCRIBE_RATE_INFINITE)
     return;
 
   time(&lastTime);
@@ -393,8 +398,17 @@ rb_winevt_subscribe_next(VALUE self)
   }
 
   if (status == ERROR_SUCCESS) {
+    // #each frees each batch in its ensure block; this covers calling #next
+    // directly in a loop.
+    for (DWORD i = 0; i < winevtSubscribe->count; i++) {
+      if (winevtSubscribe->hEvents[i]) {
+        EvtClose(winevtSubscribe->hEvents[i]);
+        winevtSubscribe->hEvents[i] = NULL;
+      }
+    }
+
     winevtSubscribe->count = count;
-    for (int i = 0; i < count; i++) {
+    for (ULONG i = 0; i < count; i++) {
       winevtSubscribe->hEvents[i] = hEvents[i];
       EvtUpdateBookmark(winevtSubscribe->bookmark, winevtSubscribe->hEvents[i]);
     }
@@ -424,12 +438,19 @@ rb_winevt_subscribe_render(VALUE self, EVT_HANDLE event)
 }
 
 static VALUE
-rb_winevt_subscribe_message(EVT_HANDLE event, LocaleInfo* localeInfo, EVT_HANDLE hRemote)
+rb_winevt_subscribe_message(struct WinevtSubscribe* winevtSubscribe, EVT_HANDLE event)
 {
   WCHAR* wResult;
   VALUE utf8str;
-
-  wResult = get_description(event, localeInfo->langID, hRemote);
+  BOOL resolved = TRUE;
+
+  wResult = get_description(event,
+                            winevtSubscribe->localeInfo->langID,
+                            winevtSubscribe->remoteHandle,
+                            &resolved);
+  if (!resolved) {
+    winevtSubscribe->unresolvedMessageCount++;
+  }
   utf8str = wstr_to_rb_str(CP_UTF8, wResult, -1);
   free(wResult);
 
@@ -450,7 +471,7 @@ rb_winevt_subscribe_close_handle(VALUE self)
   TypedData_Get_Struct(
     self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
 
-  for (int i = 0; i < winevtSubscribe->count; i++) {
+  for (DWORD i = 0; i < winevtSubscribe->count; i++) {
     if (winevtSubscribe->hEvents[i] != NULL) {
       EvtClose(winevtSubscribe->hEvents[i]);
       winevtSubscribe->hEvents[i] = NULL;
@@ -469,11 +490,10 @@ rb_winevt_subscribe_each_yield(VALUE self)
   TypedData_Get_Struct(
     self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
 
-  for (int i = 0; i < winevtSubscribe->count; i++) {
+  for (DWORD i = 0; i < winevtSubscribe->count; i++) {
     rb_yield_values(3,
                     rb_winevt_subscribe_render(self, winevtSubscribe->hEvents[i]),
-                    rb_winevt_subscribe_message(winevtSubscribe->hEvents[i], winevtSubscribe->localeInfo,
-                                                winevtSubscribe->remoteHandle),
+                    rb_winevt_subscribe_message(winevtSubscribe, winevtSubscribe->hEvents[i]),
                     rb_winevt_subscribe_string_inserts(winevtSubscribe->hEvents[i]));
   }
 
@@ -553,7 +573,7 @@ rb_winevt_subscribe_set_rate_limit(VALUE self, VALUE rb_rate_limit)
 
   rateLimit = NUM2LONG(rb_rate_limit);
 
-  if ((rateLimit != SUBSCRIBE_RATE_INFINITE) && (rateLimit < 10 || rateLimit % 10)) {
+  if ((rateLimit != (DWORD)SUBSCRIBE_RATE_INFINITE) && (rateLimit < 10 || rateLimit % 10)) {
     rb_raise(rb_eArgError, "Specify a multiples of 10 or RATE_INFINITE constant");
   } else {
     winevtSubscribe->rateLimit = rateLimit;
@@ -710,6 +730,27 @@ rb_winevt_subscribe_preserve_sid_p(VALUE self)
   return winevtSubscribe->preserveSID ? Qtrue : Qfalse;
 }
 
+/*
+ * This method returns how many events had no description message. Message
+ * resolution fails for reasons outside the caller's control (a provider whose
+ * message DLL is gone, a locale without resources), and #each degrades to an
+ * empty message instead of aborting the enumeration. The counter increases
+ * monotonically, so callers can poll it and take the difference to tell a few
+ * unresolvable events apart from a channel that resolves nothing.
+ *
+ * @return [Integer]
+ */
+static VALUE
+rb_winevt_subscribe_get_unresolved_message_count(VALUE self)
+{
+  struct WinevtSubscribe* winevtSubscribe;
+
+  TypedData_Get_Struct(
+    self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
+
+  return ULL2NUM(winevtSubscribe->unresolvedMessageCount);
+}
+
 /*
  * This method cancels channel subscription.
  *
@@ -815,6 +856,7 @@ Init_winevt_subscribe(VALUE rb_cEventLog)
    * @since 0.11.0
    */
   rb_define_method(rb_cSubscribe, "preserve_sid=", rb_winevt_subscribe_set_preserve_sid, 1);
+  rb_define_method(rb_cSubscribe, "unresolved_message_count", rb_winevt_subscribe_get_unresolved_message_count, 0);
   /*
    * @since 0.9.1
    */

data/ext/winevt/winevt_utils.cpp

@@ -2,7 +2,6 @@
 
 #include <sddl.h>
 #include <stdlib.h>
-#include <string>
 #include <vector>
 
 VALUE
@@ -127,18 +126,6 @@ connect_to_remote(LPWSTR computerName, LPWSTR domain, LPWSTR username, LPWSTR pa
   return hRemote;
 }
 
-static std::wstring
-guid_to_wstr(const GUID& guid)
-{
-  LPOLESTR p = nullptr;
-  if (FAILED(StringFromCLSID(guid, &p))) {
-    return nullptr;
-  }
-  std::wstring s(p);
-  CoTaskMemFree(p);
-  return s;
-}
-
 static VALUE
 make_displayable_binary_string(PBYTE bin, size_t length)
 {
@@ -184,8 +171,7 @@ extract_user_evt_variants(PEVT_VARIANT pRenderedValues, DWORD propCount)
         if (pRenderedValues[i].StringVal == nullptr) {
           rb_ary_push(userValues, rb_utf8_str_new_cstr("(NULL)"));
         } else {
-          std::wstring wStr(pRenderedValues[i].StringVal);
-          rbObj = wstr_to_rb_str(CP_UTF8, &wStr[0], -1);
+          rbObj = wstr_to_rb_str(CP_UTF8, pRenderedValues[i].StringVal, -1);
           rb_ary_push(userValues, rbObj);
         }
         break;
@@ -250,9 +236,12 @@ extract_user_evt_variants(PEVT_VARIANT pRenderedValues, DWORD propCount)
         break;
       case EvtVarTypeGuid:
         if (pRenderedValues[i].GuidVal != nullptr) {
-          const GUID guid = *pRenderedValues[i].GuidVal;
-          std::wstring wstr = guid_to_wstr(guid);
-          rbObj = wstr_to_rb_str(CP_UTF8, wstr.c_str(), -1);
+          WCHAR wsGuid[50];
+          if (StringFromGUID2(*pRenderedValues[i].GuidVal, wsGuid, _countof(wsGuid)) > 0) {
+              rbObj = wstr_to_rb_str(CP_UTF8, wsGuid, -1);
+          } else {
+              rbObj = rb_utf8_str_new_cstr("?");
+          }
           rb_ary_push(userValues, rbObj);
         } else {
           rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
@@ -404,128 +393,74 @@ get_values(EVT_HANDLE handle)
   return userValues;
 }
 
+/*
+ * These statuses still leave a usable (if partial) message in the buffer. The
+ * Windows SDK sample (GetEventRawDescription.cpp) and Zabbix
+ * (src/zabbix_agent/eventlog.c) treat exactly this set the same way.
+ */
+static bool
+is_partial_message(ULONG status)
+{
+  return status == ERROR_SUCCESS ||
+         status == ERROR_EVT_UNRESOLVED_VALUE_INSERT ||
+         status == ERROR_EVT_UNRESOLVED_PARAMETER_INSERT ||
+         status == ERROR_EVT_MAX_INSERTS_REACHED;
+}
+
+/*
+ * Returns the formatted message, or an empty vector when it cannot be resolved.
+ * The buffer is sized to BUFSIZE / the size EvtFormatMessage asked for, not to
+ * the string, so it carries trailing L'\0' padding: read it as a NUL-terminated
+ * string, never by size(), or the padding comes along.
+ */
 static std::vector<WCHAR>
 get_message(EVT_HANDLE hMetadata, EVT_HANDLE handle)
 {
 #define BUFSIZE 4096
   std::vector<WCHAR> result;
-  ULONG status;
-  ULONG bufferSizeNeeded = 0;
-  LPVOID lpMsgBuf;
   std::vector<WCHAR> message(BUFSIZE);
+  ULONG bufferSizeNeeded = 0;
+  ULONG status;
 
-  if (!EvtFormatMessage(hMetadata,
-                        handle,
-                        0xffffffff,
-                        0,
-                        nullptr,
-                        EvtFormatMessageEvent,
-                        message.size(),
-                        &message[0],
-                        &bufferSizeNeeded)) {
-    status = GetLastError();
-
-    if (status != ERROR_EVT_UNRESOLVED_VALUE_INSERT) {
-      switch (status) {
-        case ERROR_EVT_MESSAGE_NOT_FOUND:
-        case ERROR_EVT_MESSAGE_ID_NOT_FOUND:
-        case ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND:
-        case ERROR_RESOURCE_DATA_NOT_FOUND:
-        case ERROR_RESOURCE_TYPE_NOT_FOUND:
-        case ERROR_RESOURCE_NAME_NOT_FOUND:
-        case ERROR_RESOURCE_LANG_NOT_FOUND:
-        case ERROR_MUI_FILE_NOT_FOUND:
-        case ERROR_EVT_UNRESOLVED_PARAMETER_INSERT: {
-          if (FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM |
-                               FORMAT_MESSAGE_IGNORE_INSERTS,
-                             nullptr,
-                             status,
-                             MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-                             reinterpret_cast<WCHAR*>(&lpMsgBuf),
-                             0,
-                             nullptr) == 0)
-            FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM |
-                             FORMAT_MESSAGE_IGNORE_INSERTS,
-                           nullptr,
-                           status,
-                           MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US),
-                           reinterpret_cast<WCHAR*>(&lpMsgBuf),
-                           0,
-                           nullptr);
-
-          std::wstring ret(reinterpret_cast<WCHAR*>(lpMsgBuf));
-          std::copy(ret.begin(), ret.end(), std::back_inserter(result));
-          LocalFree(lpMsgBuf);
-
-          goto cleanup;
-        }
-      }
+  if (EvtFormatMessage(hMetadata,
+                       handle,
+                       0xffffffff,
+                       0,
+                       nullptr,
+                       EvtFormatMessageEvent,
+                       message.size(),
+                       &message[0],
+                       &bufferSizeNeeded)) {
+    return message;
+  }
 
-      if (status != ERROR_INSUFFICIENT_BUFFER)
-        rb_raise(rb_eWinevtQueryError, "ErrorCode: %lu", status);
+  status = GetLastError();
+
+  if (status == ERROR_INSUFFICIENT_BUFFER) {
+    message.resize(bufferSizeNeeded);
+
+    if (EvtFormatMessage(hMetadata,
+                         handle,
+                         0xffffffff,
+                         0,
+                         nullptr,
+                         EvtFormatMessageEvent,
+                         message.size(),
+                         &message.front(),
+                         &bufferSizeNeeded)) {
+      return message;
     }
 
-    if (status == ERROR_INSUFFICIENT_BUFFER) {
-      message.resize(bufferSizeNeeded);
-      message.shrink_to_fit();
-
-      if (!EvtFormatMessage(hMetadata,
-                            handle,
-                            0xffffffff,
-                            0,
-                            nullptr,
-                            EvtFormatMessageEvent,
-                            message.size(),
-                            &message.front(),
-                            &bufferSizeNeeded)) {
-        status = GetLastError();
-
-        if (status != ERROR_EVT_UNRESOLVED_VALUE_INSERT) {
-          switch (status) {
-            case ERROR_EVT_MESSAGE_NOT_FOUND:
-            case ERROR_EVT_MESSAGE_ID_NOT_FOUND:
-            case ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND:
-            case ERROR_RESOURCE_DATA_NOT_FOUND:
-            case ERROR_RESOURCE_TYPE_NOT_FOUND:
-            case ERROR_RESOURCE_NAME_NOT_FOUND:
-            case ERROR_RESOURCE_LANG_NOT_FOUND:
-            case ERROR_MUI_FILE_NOT_FOUND:
-            case ERROR_EVT_UNRESOLVED_PARAMETER_INSERT:
-              if (FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
-                                   FORMAT_MESSAGE_FROM_SYSTEM |
-                                   FORMAT_MESSAGE_IGNORE_INSERTS,
-                                 nullptr,
-                                 status,
-                                 MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-                                 reinterpret_cast<WCHAR*>(&lpMsgBuf),
-                                 0,
-                                 nullptr) == 0)
-                FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER |
-                                 FORMAT_MESSAGE_FROM_SYSTEM |
-                                 FORMAT_MESSAGE_IGNORE_INSERTS,
-                               nullptr,
-                               status,
-                               MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US),
-                               reinterpret_cast<WCHAR*>(&lpMsgBuf),
-                               0,
-                               nullptr);
-
-              std::wstring ret(reinterpret_cast<WCHAR*>(lpMsgBuf));
-              std::copy(ret.begin(), ret.end(), std::back_inserter(result));
-              LocalFree(lpMsgBuf);
-
-              goto cleanup;
-          }
-
-          rb_raise(rb_eWinevtQueryError, "ErrorCode: %lu", status);
-        }
-      }
-    }
+    status = GetLastError();
   }
 
-  result = message;
-
-cleanup:
+  // Message resolution fails for open-ended reasons -- a message DLL removed
+  // from disk, a locale without resources, anything LoadLibraryEx surfaces --
+  // so there is no error set to enumerate. Raising on "unknown" statuses would
+  // let one unresolvable event abort the whole #each enumeration.
+  if (is_partial_message(status)) {
+    result = message;
+  }
 
   return result;
 
@@ -533,27 +468,37 @@ cleanup:
 }
 
 WCHAR*
-get_description(EVT_HANDLE handle, LANGID langID, EVT_HANDLE hRemote)
+get_description(EVT_HANDLE handle, LANGID langID, EVT_HANDLE hRemote, BOOL* resolved)
 {
 #define BUFSIZE 4096
-  std::vector<WCHAR> buffer(BUFSIZE);
+  // rb_raise longjmps out of this frame without running C++ destructors, and
+  // both error paths below raise. Ruby owns this buffer so the GC still
+  // reclaims it on those paths; a std::vector here would leak its storage.
+  VALUE vbuffer;
+  WCHAR* buffer = RB_ALLOCV_N(WCHAR, vbuffer, BUFSIZE);
   ULONG bufferSizeNeeded = 0;
   ULONG status, count;
   std::vector<WCHAR> result;
   EVT_HANDLE hMetadata = nullptr;
 
+  if (resolved)
+    *resolved = TRUE;
+
   static PCWSTR eventProperties[] = { L"Event/System/Provider/@Name" };
   EVT_HANDLE renderContext =
     EvtCreateRenderContext(1, eventProperties, EvtRenderContextValues);
   if (renderContext == nullptr) {
+    RB_ALLOCV_END(vbuffer);
     rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
   }
 
+  // EvtRender sizes in bytes, not characters, and this call has no retry: a
+  // short size turns into ERROR_INSUFFICIENT_BUFFER and raises below.
   if (EvtRender(renderContext,
                 handle,
                 EvtRenderEventValues,
-                buffer.size(),
-                &buffer.front(),
+                BUFSIZE * sizeof(WCHAR),
+                buffer,
                 &bufferSizeNeeded,
                 &count) != FALSE) {
     status = ERROR_SUCCESS;
@@ -563,11 +508,20 @@ get_description(EVT_HANDLE handle, LANGID langID, EVT_HANDLE hRemote)
 
   if (status != ERROR_SUCCESS) {
     EvtClose(renderContext);
+    RB_ALLOCV_END(vbuffer);
     raise_system_error(rb_eWinevtQueryError, status);
   }
 
-  // Obtain buffer as EVT_VARIANT pointer. To avoid ErrorCide 87 in EvtRender.
-  const PEVT_VARIANT values = reinterpret_cast<PEVT_VARIANT>(&buffer.front());
+  // Obtain buffer as EVT_VARIANT pointer. To avoid ErrorCode 87 in EvtRender.
+  const PEVT_VARIANT values = reinterpret_cast<PEVT_VARIANT>(buffer);
+
+  // EvtRender reports what it actually wrote, and the buffer is not zeroed, so
+  // values[0] is only meaningful once count says it was filled in. A truncated
+  // event -- more likely arriving over a remote session -- would otherwise hand
+  // EvtOpenPublisherMetadata whatever the buffer happened to contain.
+  if (count == 0 || values[0].Type != EvtVarTypeString) {
+    goto cleanup;
+  }
 
   // Open publisher metadata
   hMetadata = EvtOpenPublisherMetadata(
@@ -588,12 +542,22 @@ get_description(EVT_HANDLE handle, LANGID langID, EVT_HANDLE hRemote)
 
 cleanup:
 
+  RB_ALLOCV_END(vbuffer);
+
   if (renderContext)
     EvtClose(renderContext);
 
   if (hMetadata)
     EvtClose(hMetadata);
 
+  // Both ways of giving up -- publisher metadata that cannot be opened, and
+  // EvtFormatMessage failing to resolve -- end up here with an empty result.
+  if (result.empty()) {
+    if (resolved)
+      *resolved = FALSE;
+    return _wcsdup(L"");
+  }
+
   return _wcsdup(result.data());
 }
 
@@ -703,7 +667,10 @@ render_system_event(EVT_HANDLE hEvent, BOOL preserve_qualifiers, BOOL preserveSI
   DWORD dwBufferSize = 0;
   DWORD dwBufferUsed = 0;
   DWORD dwPropertyCount = 0;
-  VALUE vRenderedValues;
+  // The error path below runs RB_ALLOCV_END() whether or not RB_ALLOCV() was
+  // reached, and RB_ALLOCV_END() dereferences anything non-zero. Zero, not
+  // Qnil, is the value it treats as "nothing was allocated".
+  VALUE vRenderedValues = 0;
   PEVT_VARIANT pRenderedValues = NULL;
   WCHAR wsGuid[50];
   LPSTR pwsSid = NULL;
@@ -848,16 +815,20 @@ render_system_event(EVT_HANDLE hEvent, BOOL preserve_qualifiers, BOOL preserveSI
                  rb_str_new2("TimeCreated"),
                  Qnil);
   }
-  _snprintf_s(buffer,
-              _countof(buffer),
-              _TRUNCATE,
-              "%llu",
-              pRenderedValues[EvtSystemEventRecordId].UInt64Val);
-  rb_hash_aset(hash,
-               rb_str_new2("EventRecordID"),
-               (EvtVarTypeNull == pRenderedValues[EvtSystemEventRecordId].UInt64Val)
-                 ? Qnil
-                 : rb_str_new2(buffer));
+  if (EvtVarTypeNull != pRenderedValues[EvtSystemEventRecordId].Type) {
+    _snprintf_s(buffer,
+                _countof(buffer),
+                _TRUNCATE,
+                "%llu",
+                pRenderedValues[EvtSystemEventRecordId].UInt64Val);
+    rb_hash_aset(hash,
+                 rb_str_new2("EventRecordID"),
+                 rb_str_new2(buffer));
+  } else {
+    rb_hash_aset(hash,
+                 rb_str_new2("EventRecordID"),
+                 Qnil);
+  }
 
   if (EvtVarTypeNull != pRenderedValues[EvtSystemActivityID].Type) {
     const GUID* Guid = pRenderedValues[EvtSystemActivityID].GuidVal;

data/lib/winevt/version.rb

@@ -1,3 +1,3 @@
 module Winevt
-  VERSION = "0.11.4"
+  VERSION = "0.11.6"
 end

data/winevt_c.gemspec

@@ -23,7 +23,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
   spec.extensions = ["ext/winevt/extconf.rb"]
   spec.license = "Apache-2.0"
-  spec.required_ruby_version = Gem::Requirement.new(">= 2.4".freeze)
+  spec.required_ruby_version = Gem::Requirement.new(">= 3.2".freeze)
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake", "~> 13.0"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: winevt_c
 version: !ruby/object:Gem::Version
-  version: 0.11.4
+  version: 0.11.6
 platform: ruby
 authors:
 - Hiroshi Hatake
@@ -132,14 +132,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.4'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Windows Event Log API bindings from winevt.h.
 test_files: []