search

3gstudent / Eventlogedit-evtx--Evolution

Remove individual lines from Windows XML Event Log (EVTX) files
256 stars 62 forks source link

FreeSpaceOffset is 0 #12

Open basicDaveDev opened 3 years ago

basicDaveDev commented 3 years ago

At the file Eventlogedit-evtx--Evolution/DeleteRecordofFile.cpp

unsigned char *ChecksumBuf1 = new unsigned char[currentChunk->FreeSpaceOffset - 512];
                memcpy(ChecksumBuf1, (PBYTE)currentChunk + 512, currentChunk->FreeSpaceOffset - 512);
                crc32 = GetCRC32(ChecksumBuf1, currentChunk->FreeSpaceOffset - 512);

In this portion of code, you may have a bug/untreated case if there is the value of FreeSpaceOffset is 0.

vklymchuk commented 3 years ago

the same problem (