| 121 | } |
| 122 | |
| 123 | std::string WindowsEventLogMetadataImpl::getEventData(EVT_FORMAT_MESSAGE_FLAGS flags) const { |
| 124 | WCHAR stack_buffer[4096]; |
| 125 | DWORD num_chars_in_buffer = sizeof(stack_buffer) / sizeof(stack_buffer[0]); |
| 126 | using Deleter = utils::StackAwareDeleter<WCHAR, utils::FreeDeleter>; |
| 127 | std::unique_ptr<WCHAR, Deleter> buffer{ stack_buffer, Deleter{stack_buffer} }; |
| 128 | DWORD num_chars_used = 0; |
| 129 | DWORD result = 0; |
| 130 | |
| 131 | std::string event_data; |
| 132 | |
| 133 | if (metadata_ptr_ == NULL || event_ptr_ == NULL) { |
| 134 | return event_data; |
| 135 | } |
| 136 | |
| 137 | |
| 138 | if (!EvtFormatMessage(metadata_ptr_, event_ptr_, 0, 0, NULL, flags, num_chars_in_buffer, buffer.get(), &num_chars_used)) { |
| 139 | result = GetLastError(); |
| 140 | if (ERROR_INSUFFICIENT_BUFFER == result) { |
| 141 | num_chars_in_buffer = num_chars_used; |
| 142 | |
| 143 | buffer.reset((LPWSTR) malloc(num_chars_in_buffer * sizeof(WCHAR))); |
| 144 | if (!buffer) { |
| 145 | return event_data; |
| 146 | } |
| 147 | |
| 148 | EvtFormatMessage(metadata_ptr_, event_ptr_, 0, 0, NULL, flags, num_chars_in_buffer, buffer.get(), &num_chars_used); |
| 149 | } |
| 150 | } |
| 151 | if (EvtFormatMessageKeyword == flags) { |
| 152 | buffer.get()[num_chars_used - 1] = L'\0'; |
| 153 | } |
| 154 | std::wstring str(buffer.get()); |
| 155 | event_data = std::string(str.begin(), str.end()); |
| 156 | return event_data; |
| 157 | } |
| 158 | |
| 159 | std::string WindowsEventLogHandler::getEventMessage(EVT_HANDLE eventHandle) const { |
| 160 | std::string returnValue; |