[EVENTLOG]

LogfInitializeExisting: Do not try to write to a file that has been opened as a backup file. It has been opened read-only.

svn path=/trunk/; revision=61026
This commit is contained in:
Eric Kohl 2013-11-17 22:30:55 +00:00
parent d8cadc59dc
commit 7a6fccdcf6

View file

@ -82,7 +82,7 @@ LogfInitializeNew(PLOGFILE LogFile)
static NTSTATUS
LogfInitializeExisting(PLOGFILE LogFile)
LogfInitializeExisting(PLOGFILE LogFile, BOOL Backup)
{
DWORD dwRead;
DWORD dwRecordsNumber = 0;
@ -264,6 +264,8 @@ LogfInitializeExisting(PLOGFILE LogFile)
But for now limit EventLog size to just under 5K. */
LogFile->Header.MaxSize = 5000;
if (!Backup)
{
if (SetFilePointer(LogFile->hFile, 0, NULL, FILE_BEGIN) ==
INVALID_SET_FILE_POINTER)
{
@ -286,6 +288,7 @@ LogfInitializeExisting(PLOGFILE LogFile)
DPRINT1("FlushFileBuffers failed! %d\n", GetLastError());
return STATUS_EVENTLOG_FILE_CORRUPT;
}
}
return STATUS_SUCCESS;
}
@ -380,7 +383,7 @@ LogfCreate(PLOGFILE *LogFile,
if (bCreateNew)
Status = LogfInitializeNew(pLogFile);
else
Status = LogfInitializeExisting(pLogFile);
Status = LogfInitializeExisting(pLogFile, Backup);
if (!NT_SUCCESS(Status))
goto fail;