🚀 go-pugleaf

St�phane Lambert wrote:

>  EVENTLOGRECORD CurrentEventLogRecord = {0};
>  bool bSucceeded = ReadEventLog( hSystemEventLog,
>            EVENTLOG_BACKWARDS_READ | EVENTLOG_SEQUENTIAL_READ,
>                                  0,
>                                  &CurrentEventLogRecord,
>                                  sizeof( CurrentEventLogRecord ),
>                                  &dwBytesRead,
>                                  &dwBytesNeeded );
>  if ( bSucceeded == false )
>  {
>   showWindowsLastErrorMessage();

Also display sizeof(CurrentEventLogRecord) and dwBytesNeeded.
I suspect dwBytesNeeded is larger by a few bytes.

>When this code is executed, I get the following error:
> The data area passed to a system call is too small.
>
>What's the problem with this code?

Microsoft's example code uses a (large) char buffer,
and a moveable struct pointer. They also mention
there might be padding bytes added to the struct.
If you were supposed to read directly into a struct,
they probably would have shown it that way.