Skip to content

Bug reading Application event log #38

@drgcms

Description

@drgcms

Description

The program uses all available memory while reading the Application log until it dies.

Gem Version

0.6.7, Ruby 3.1 (happens in older Ruby versions too)

Windows Version

Windows Server 2022

Replication Case

The problem is near line 1090:

 # Determine higest %n insert number
max_insert = [num, buf.read_string.scan(INSERT_NUMBER_REGEX).map { |x| x[0].to_i }.max].compact.max

max_insert value is calculated as 100790273 and program is allocating memory in following line until it dies.

 # Insert dummy strings not provided by caller
   ((num+1)..(max_insert)).each{ |x| va_list.push("%#{x}") }

My temporary solution is to maximize value of max_insert.

   max_insert = 1024 if max_insert > 1024

which resolves the problem of the dying program but not the reason.

Event log in XML. So far this is the only event that is causing problems.

+ <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Group Policy Drive Maps" /> 
  <EventID Qualifiers="34305">4098</EventID> 
  <Level>3</Level> 
  <Task>2</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2022-08-08T09:35:06.242315900Z" /> 
  <EventRecordID>150800</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>my.server</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data>user</Data> 
  <Data>M:</Data> 
  <Data>Default Domain Policy {31B2F340-016D-11D2-945F-00C04FB984F9}</Data> 
  <Data>0x80070056 The specified network password is not correct.</Data> 
  </EventData>
  </Event>

by
TheR

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions