Description Dave Smith 2006-06-13 14:23:46 EDT

The Reader.cpp Windows event log reader program that is used to convert the log to a text file so it can be parsed by GLA should be cleaned up.  There is some code that potentially could cause buffer overruns.  For example the following code is included in GetDescriptionString:

	// Since the description text could not be retrieved get the message strings
	*pMessage = new char[(record->DataOffset - record->StringOffset) + 5];
	DWORD recordStringStart = (DWORD)record + record->StringOffset;
	LPSTR recordString = (LPSTR)recordStringStart;


	// initialize the array to nulls
	memset(*pMessage, NULL, (record->DataOffset - record->StringOffset));

	for (int i=0; i < record->NumStrings; i++)
	{
		removeNewLine(recordString);
		strcat(*pMessage, recordString);
		strcat(*pMessage, " ");
		recordStringStart = recordStringStart + strlen(recordString) + 1;
		recordString = (LPSTR)recordStringStart;
	}

The array in pMessage may not be allocated large enough to hold all of the strings and the initialization of the array to NULL's does not cover all of the array (eg the 5 extra bytes allocated).  This new array is not freed so there is a memory leak.

The string returned by FormatMessage is never freed either.  See documentation for FormatMessage.

Also, comments should be added to the code to make it more maintainable.