[release/8.0-staging] Workaround bug in EvtFormatMessage #105762
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport of #105636 to release/8.0-staging
/cc @ericstj
Customer Impact
Customer reading EventLog records encounters a crash. No way to predict the crash or workaround it (it's an AV, not a managed exception).
Root cause is a misbehaving windows API that writes
\0
to a buffer even when it's NULL and zero length. We'll workaround this by giving the API a small buffer to write a single character to.Regression
Regressed in 6.0 with #61990. That change removed the use of StringBuilder, which was previously providing a default buffer of length 16, even when we told the API it was 0 length.
Testing
Manually verified with customer provided data.
Risk
Low - we're adding back a small buffer to receive a copied null value. Should Windows fix this bug in a future version, we'll still be OK with the workaround we've added.