williballenthin / python-evt

Pure Python parser for classic Windows Event Log files (.evt)
Apache License 2.0
48 stars 11 forks source link

Fix infinite loop in event carving #2

Closed zrweger closed 8 years ago

zrweger commented 8 years ago

len(buf) can be < _chunksize near the end of the file, and the record's length can be larger, but less than _maxrecord.

In this situation, we can get an infinite loop where we're constantly hitting "shifting file offset forward".