winevt_c 0.3.8 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac595d99bc6422ccdbbd74c8df98fad0fea9a6679c3858cc891d898cd22c6062
-  data.tar.gz: 42c8309fadbbc077f4999aa14b91e7a5d15f28747ad24961609d6152370ac12d
+  metadata.gz: 244a14b164c848b25d2aa5dbc75c5ccdbdb7af62424f37f6463d1be30b673484
+  data.tar.gz: 954aa6d48fd5643d5992841f926c17b0b5c38790f6c1e9e9a4c37c2a2974c4ee
 SHA512:
-  metadata.gz: ee9d551fb4c229631e70b1e2e779fcebb3f87fe99a7c795a8a3fa9278ee8e7a2f8cfcad156f8189b380613d63746625913cb00dd7505f232ed6ea2dbc74fcfbd
-  data.tar.gz: 98af1f800f0628d2ddd96d974f9fa5ade5e1dfa9a5026a45ef3ab805516b860019c219af49bc3335f065725e1800202a474aaa18dd2abbc6e8826048b1588899
+  metadata.gz: ac5be5abad00314ee60ec70c914ff53523eea1a918c17133fdde614d2638ddad9fab8f72dd9d57c492b467deaaf0c0c99b58a178b9b3dd072c42656ce93c8e3d
+  data.tar.gz: 59a8a65f8a68c6548f46863e3b82345a5bb0f0a679a63c900e5dd29232940ab421f16b52c0859e1d87430202ca3797b84674b8b6b2cf8d5d3d96aa3bba6d69f8

data/ext/winevt/winevt_bookmark.c

@@ -79,14 +79,19 @@ rb_winevt_bookmark_update(VALUE self, VALUE event)
 static VALUE
 rb_winevt_bookmark_render(VALUE self)
 {
+  WCHAR* wResult;
   char* result;
   struct WinevtBookmark *winevtBookmark;
+  VALUE utf8str;
 
   TypedData_Get_Struct(self, struct WinevtBookmark, &rb_winevt_bookmark_type, winevtBookmark);
+  wResult = render_event(winevtBookmark->bookmark, EvtRenderBookmark);
+  result = wstr_to_mbstr(CP_UTF8, wResult, -1);
 
-  result = render_event(winevtBookmark->bookmark, EvtRenderBookmark);
+  utf8str = rb_utf8_str_new_cstr(result);
+  free_allocated_mbstr(result);
 
-  return rb_str_new2(result);
+  return utf8str;
 }
 
 void Init_winevt_bookmark(VALUE rb_cEventLog)

data/ext/winevt/winevt_c.h

@@ -22,8 +22,9 @@
 #define EventChannel(object) ((struct WinevtChannel *)DATA_PTR(object))
 
 char* wstr_to_mbstr(UINT cp, const WCHAR *wstr, int clen);
-char* render_event(EVT_HANDLE handle, DWORD flags);
-char* get_description(EVT_HANDLE handle);
+void free_allocated_mbstr(const char* str);
+WCHAR* render_event(EVT_HANDLE handle, DWORD flags);
+WCHAR* get_description(EVT_HANDLE handle);
 VALUE get_values(EVT_HANDLE handle);
 
 VALUE rb_cQuery;

data/ext/winevt/winevt_channel.c

@@ -49,6 +49,7 @@ rb_winevt_channel_each(VALUE self)
   DWORD bufferSize = 0;
   DWORD bufferUsed = 0;
   DWORD status = ERROR_SUCCESS;
+  VALUE utf8str;
 
   RETURN_ENUMERATOR(self, 0, 0);
 
@@ -88,7 +89,10 @@ rb_winevt_channel_each(VALUE self)
 
     result = wstr_to_mbstr(CP_UTF8, buffer, -1);
 
-    rb_yield(rb_utf8_str_new_cstr(result));
+    utf8str = rb_utf8_str_new_cstr(result);
+    free_allocated_mbstr(result);
+
+    rb_yield(utf8str);
   }
 
   return Qnil;

data/ext/winevt/winevt_query.c

@@ -137,25 +137,37 @@ rb_winevt_query_next(VALUE self)
 static VALUE
 rb_winevt_query_render(VALUE self)
 {
+  WCHAR* wResult;
   char* result;
   struct WinevtQuery *winevtQuery;
+  VALUE utf8str;
 
   TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-  result = render_event(winevtQuery->event, EvtRenderEventXml);
+  wResult = render_event(winevtQuery->event, EvtRenderEventXml);
+  result = wstr_to_mbstr(CP_UTF8, wResult, -1);
 
-  return rb_utf8_str_new_cstr(result);
+  utf8str = rb_utf8_str_new_cstr(result);
+  free_allocated_mbstr(result);
+
+  return utf8str;
 }
 
 static VALUE
 rb_winevt_query_message(VALUE self)
 {
+  WCHAR* wResult;
   char* result;
   struct WinevtQuery *winevtQuery;
+  VALUE utf8str;
 
   TypedData_Get_Struct(self, struct WinevtQuery, &rb_winevt_query_type, winevtQuery);
-  result = get_description(winevtQuery->event);
+  wResult = get_description(winevtQuery->event);
+  result = wstr_to_mbstr(CP_UTF8, wResult, -1);
+
+  utf8str = rb_utf8_str_new_cstr(result);
+  free_allocated_mbstr(result);
 
-  return rb_utf8_str_new_cstr(result);
+  return utf8str;
 }
 
 static VALUE

data/ext/winevt/winevt_subscribe.c

@@ -153,25 +153,37 @@ rb_winevt_subscribe_next(VALUE self)
 static VALUE
 rb_winevt_subscribe_render(VALUE self)
 {
+  WCHAR* wResult;
   char* result;
   struct WinevtSubscribe *winevtSubscribe;
+  VALUE utf8str;
 
   TypedData_Get_Struct(self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
-  result = render_event(winevtSubscribe->event, EvtRenderEventXml);
+  wResult = render_event(winevtSubscribe->event, EvtRenderEventXml);
+  result = wstr_to_mbstr(CP_UTF8, wResult, -1);
 
-  return rb_utf8_str_new_cstr(result);
+  utf8str = rb_utf8_str_new_cstr(result);
+  free_allocated_mbstr(result);
+
+  return utf8str;
 }
 
 static VALUE
 rb_winevt_subscribe_message(VALUE self)
 {
+  WCHAR* wResult;
   char* result;
   struct WinevtSubscribe *winevtSubscribe;
+  VALUE utf8str;
 
   TypedData_Get_Struct(self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
-  result = get_description(winevtSubscribe->event);
+  wResult = get_description(winevtSubscribe->event);
+  result = wstr_to_mbstr(CP_UTF8, wResult, -1);
+
+  utf8str = rb_utf8_str_new_cstr(result);
+  free_allocated_mbstr(result);
 
-  return rb_utf8_str_new_cstr(result);
+  return utf8str;
 }
 
 static VALUE
@@ -205,14 +217,20 @@ rb_winevt_subscribe_each(VALUE self)
 static VALUE
 rb_winevt_subscribe_get_bookmark(VALUE self)
 {
+  WCHAR* wResult;
   char* result;
   struct WinevtSubscribe *winevtSubscribe;
+  VALUE utf8str;
 
   TypedData_Get_Struct(self, struct WinevtSubscribe, &rb_winevt_subscribe_type, winevtSubscribe);
 
-  result = render_event(winevtSubscribe->bookmark, EvtRenderBookmark);
+  wResult = render_event(winevtSubscribe->bookmark, EvtRenderBookmark);
+  result = wstr_to_mbstr(CP_UTF8, wResult, -1);
+
+  utf8str = rb_utf8_str_new_cstr(result);
+  free_allocated_mbstr(result);
 
-  return rb_str_new2(result);
+  return utf8str;
 }
 
 void Init_winevt_subscribe(VALUE rb_cEventLog)

data/ext/winevt/winevt_utils.c

@@ -13,20 +13,26 @@ wstr_to_mbstr(UINT cp, const WCHAR *wstr, int clen)
     return ptr;
 }
 
-char* render_event(EVT_HANDLE handle, DWORD flags)
+void free_allocated_mbstr(const char* str)
+{
+  if (str)
+    xfree((char *)str);
+}
+
+WCHAR* render_event(EVT_HANDLE handle, DWORD flags)
 {
   PWSTR      buffer = NULL;
   ULONG      bufferSize = 0;
   ULONG      bufferSizeNeeded = 0;
   ULONG      status, count;
-  char*      result;
+  static WCHAR* result = L"";
   LPTSTR     msgBuf;
 
   do {
     if (bufferSizeNeeded > bufferSize) {
       free(buffer);
       bufferSize = bufferSizeNeeded;
-      buffer = malloc(bufferSize);
+      buffer = xmalloc(bufferSize);
       if (buffer == NULL) {
         status = ERROR_OUTOFMEMORY;
         bufferSize = 0;
@@ -63,10 +69,10 @@ char* render_event(EVT_HANDLE handle, DWORD flags)
     rb_raise(rb_eWinevtQueryError, "ErrorCode: %d\nError: %s\n", status, RSTRING_PTR(errmsg));
   }
 
-  result = wstr_to_mbstr(CP_UTF8, buffer, -1);
+  result = buffer;
 
   if (buffer)
-    free(buffer);
+    xfree(buffer);
 
   return result;
 }
@@ -92,7 +98,7 @@ VALUE get_values(EVT_HANDLE handle)
     if (bufferSizeNeeded > bufferSize) {
       free(buffer);
       bufferSize = bufferSizeNeeded;
-      buffer = malloc(bufferSize);
+      buffer = xmalloc(bufferSize);
       if (buffer == NULL) {
         status = ERROR_OUTOFMEMORY;
         bufferSize = 0;
@@ -147,6 +153,7 @@ VALUE get_values(EVT_HANDLE handle)
       } else {
         result = wstr_to_mbstr(CP_UTF8, pRenderedValues[i].StringVal, -1);
         rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+        free_allocated_mbstr(result);
       }
       break;
     case EvtVarTypeAnsiString:
@@ -191,6 +198,7 @@ VALUE get_values(EVT_HANDLE handle)
     case EvtVarTypeSingle:
       sprintf(result, "%f", pRenderedValues[i].SingleVal);
       rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+      free_allocated_mbstr(result);
       break;
     case EvtVarTypeDouble:
       sprintf(result, "%lf", pRenderedValues[i].DoubleVal);
@@ -205,6 +213,7 @@ VALUE get_values(EVT_HANDLE handle)
         StringFromCLSID(pRenderedValues[i].GuidVal, &tmpWChar);
         result = wstr_to_mbstr(CP_UTF8, tmpWChar, -1);
         rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+        free_allocated_mbstr(result);
       } else {
         rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
       }
@@ -243,6 +252,7 @@ VALUE get_values(EVT_HANDLE handle)
       if (ConvertSidToStringSidW(pRenderedValues[i].SidVal, &tmpWChar)) {
         result = wstr_to_mbstr(CP_UTF8, tmpWChar, -1);
         rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+        free_allocated_mbstr(result);
       } else {
         rb_ary_push(userValues, rb_utf8_str_new_cstr("?"));
       }
@@ -263,6 +273,7 @@ VALUE get_values(EVT_HANDLE handle)
       } else {
         result = wstr_to_mbstr(CP_UTF8, pRenderedValues[i].XmlVal, -1);
         rb_ary_push(userValues, rb_utf8_str_new_cstr(result));
+        free_allocated_mbstr(result);
       }
       break;
     default:
@@ -272,70 +283,26 @@ VALUE get_values(EVT_HANDLE handle)
   }
 
   if (buffer)
-    free(buffer);
+    xfree(buffer);
+
+  if (renderContext)
+    EvtClose(renderContext);
 
   return userValues;
 }
 
-char* get_description(EVT_HANDLE handle)
+static WCHAR* get_message(EVT_HANDLE hMetadata, EVT_HANDLE handle)
 {
-#define MAX_BUFFER 65535
-  WCHAR      buffer[4096], *msg = buffer;
-  WCHAR      descriptionBuffer[MAX_BUFFER];
-  ULONG      bufferSize = 0;
-  ULONG      bufferSizeNeeded = 0;
-  ULONG      status, count;
-  char*      result = "";
-  LPTSTR     msgBuf = "";
-  EVT_HANDLE hMetadata = NULL;
-  PEVT_VARIANT values = NULL;
+#define BUFSIZE 4096
+  static WCHAR* result = L"";
+  ULONG  status;
+  ULONG bufferSizeNeeded = 0;
   LPVOID lpMsgBuf;
+  WCHAR*     prevBuffer;
+  WCHAR     *message;
 
-  static PCWSTR eventProperties[] = {L"Event/System/Provider/@Name"};
-  EVT_HANDLE renderContext = EvtCreateRenderContext(1, eventProperties, EvtRenderContextValues);
-  if (renderContext == NULL) {
-    rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
-  }
-
-  if (EvtRender(renderContext,
-                handle,
-                EvtRenderEventValues,
-                _countof(buffer),
-                buffer,
-                &bufferSizeNeeded,
-                &count) != FALSE) {
-    status = ERROR_SUCCESS;
-  } else {
-    status = GetLastError();
-  }
-
-  if (status != ERROR_SUCCESS) {
-    FormatMessage(
-        FORMAT_MESSAGE_ALLOCATE_BUFFER |
-        FORMAT_MESSAGE_FROM_SYSTEM |
-        FORMAT_MESSAGE_IGNORE_INSERTS,
-        NULL, status,
-        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
-        msgBuf, 0, NULL);
-
-    VALUE errmsg = rb_str_new2(msgBuf);
-    LocalFree(msgBuf);
-
-    rb_raise(rb_eWinevtQueryError, "ErrorCode: %d\nError: %s\n", status, RSTRING_PTR(errmsg));
-  }
-
-  // Obtain buffer as EVT_VARIANT pointer. To avoid ErrorCide 87 in EvtRender.
-  values = (PEVT_VARIANT)buffer;
-
-  // Open publisher metadata
-  hMetadata = EvtOpenPublisherMetadata(NULL, values[0].StringVal, NULL, MAKELCID(MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), SORT_DEFAULT), 0);
-  if (hMetadata == NULL) {
-    // When winevt_c cannot open metadata, then give up to obtain
-    // message file and clean up immediately.
-    goto cleanup;
-  }
-
-  if (!EvtFormatMessage(hMetadata, handle, 0xffffffff, 0, NULL, EvtFormatMessageEvent, 4096, buffer, &bufferSizeNeeded)) {
+  message = (WCHAR *)xmalloc(sizeof(WCHAR) * BUFSIZE);
+  if (!EvtFormatMessage(hMetadata, handle, 0xffffffff, 0, NULL, EvtFormatMessageEvent, BUFSIZE, message, &bufferSizeNeeded)) {
     status = GetLastError();
 
     if (status != ERROR_EVT_UNRESOLVED_VALUE_INSERT) {
@@ -361,7 +328,8 @@ char* get_description(EVT_HANDLE handle)
                          MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US),
                          (WCHAR *) &lpMsgBuf, 0, NULL);
 
-        result = wstr_to_mbstr(CP_UTF8, (WCHAR *)lpMsgBuf, -1);
+        result = (WCHAR *)lpMsgBuf;
+        LocalFree(lpMsgBuf);
 
         goto cleanup;
       }
@@ -373,9 +341,10 @@ char* get_description(EVT_HANDLE handle)
     }
 
     if (status == ERROR_INSUFFICIENT_BUFFER) {
-      msg = (WCHAR *)malloc(sizeof(WCHAR) * bufferSizeNeeded);
+      prevBuffer = message;
+      message = (WCHAR *)realloc(prevBuffer, sizeof(WCHAR) * bufferSizeNeeded);
 
-      if(!EvtFormatMessage(hMetadata, handle, 0xffffffff, 0, NULL, EvtFormatMessageEvent, bufferSizeNeeded, msg, &bufferSizeNeeded)) {
+      if(!EvtFormatMessage(hMetadata, handle, 0xffffffff, 0, NULL, EvtFormatMessageEvent, bufferSizeNeeded, message, &bufferSizeNeeded)) {
         status = GetLastError();
 
         if (status != ERROR_EVT_UNRESOLVED_VALUE_INSERT) {
@@ -401,7 +370,8 @@ char* get_description(EVT_HANDLE handle)
                              MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US),
                              (WCHAR *) &lpMsgBuf, 0, NULL);
 
-            result = wstr_to_mbstr(CP_UTF8, (WCHAR *)lpMsgBuf, -1);
+            result = (WCHAR *)lpMsgBuf;
+            LocalFree(lpMsgBuf);
 
             goto cleanup;
           }
@@ -411,9 +381,78 @@ char* get_description(EVT_HANDLE handle)
       }
     }
   }
-  result = wstr_to_mbstr(CP_UTF8, msg, -1);
 
-#undef MAX_BUFFER
+  result = message;
+
+cleanup:
+
+  if (message)
+    xfree(message);
+
+  return result;
+
+#undef BUFSIZE
+}
+
+WCHAR* get_description(EVT_HANDLE handle)
+{
+#define BUFSIZE 4096
+  WCHAR      buffer[BUFSIZE];
+  ULONG      bufferSize = 0;
+  ULONG      bufferSizeNeeded = 0;
+  ULONG      status, count;
+  static WCHAR *result = L"";
+  LPTSTR     msgBuf = "";
+  EVT_HANDLE hMetadata = NULL;
+  PEVT_VARIANT values = NULL;
+
+  static PCWSTR eventProperties[] = {L"Event/System/Provider/@Name"};
+  EVT_HANDLE renderContext = EvtCreateRenderContext(1, eventProperties, EvtRenderContextValues);
+  if (renderContext == NULL) {
+    rb_raise(rb_eWinevtQueryError, "Failed to create renderContext");
+  }
+
+  if (EvtRender(renderContext,
+                handle,
+                EvtRenderEventValues,
+                _countof(buffer),
+                buffer,
+                &bufferSizeNeeded,
+                &count) != FALSE) {
+    status = ERROR_SUCCESS;
+  } else {
+    status = GetLastError();
+  }
+
+  if (status != ERROR_SUCCESS) {
+    FormatMessage(
+        FORMAT_MESSAGE_ALLOCATE_BUFFER |
+        FORMAT_MESSAGE_FROM_SYSTEM |
+        FORMAT_MESSAGE_IGNORE_INSERTS,
+        NULL, status,
+        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+        msgBuf, 0, NULL);
+
+    VALUE errmsg = rb_str_new2(msgBuf);
+    LocalFree(msgBuf);
+
+    rb_raise(rb_eWinevtQueryError, "ErrorCode: %d\nError: %s\n", status, RSTRING_PTR(errmsg));
+  }
+
+  // Obtain buffer as EVT_VARIANT pointer. To avoid ErrorCide 87 in EvtRender.
+  values = (PEVT_VARIANT)buffer;
+
+  // Open publisher metadata
+  hMetadata = EvtOpenPublisherMetadata(NULL, values[0].StringVal, NULL, MAKELCID(MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), SORT_DEFAULT), 0);
+  if (hMetadata == NULL) {
+    // When winevt_c cannot open metadata, then give up to obtain
+    // message file and clean up immediately.
+    goto cleanup;
+  }
+
+  result = get_message(hMetadata, handle);
+
+#undef BUFSIZE
 
 cleanup:
 

data/lib/winevt/version.rb

@@ -1,3 +1,3 @@
 module Winevt
-  VERSION = "0.3.8"
+  VERSION = "0.4.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: winevt_c
 version: !ruby/object:Gem::Version
-  version: 0.3.8
+  version: 0.4.0
 platform: ruby
 authors:
 - Hiroshi Hatake
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-06-27 00:00:00.000000000 Z
+date: 2019-06-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler