microsoft / etl2pcapng

Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.
MIT License
607 stars 114 forks source link

Refactor VMNic Interface property retrieval #76

Closed dkontyko closed 2 months ago

dkontyko commented 6 months ago

This commit refactors the property retrieval code in AddInterface into a separate function. It rewrites the memory allocations and copies to ensure that memory bounds are properly addressed, to prevent any buffer overflows or off-by-one errors. The removed code was being flagged by a static analyzer.

I tested the original (main branch) and modified binaries with an ETL sample I captured on an arm64 Win11 VM. The resulting pcapng files hashed the same.

Tagging @maolson-msft for any feedback on PR, thanks in advance.