[pkg/stanza] Pass buffer by reference so buffer changes are not lost (#…

…36252)

The root of the crash reported in #36179 was the fact that the `Buffer`
struct being passed by value in recursive calls made it allocate the
needed amount, but, after the return of the recursive call it attempted
to read a buffer that was larger than the allocated buffer on the
recursive call.

The crash was going to be hit whenever an XML was larger than the
default size of the buffer (16KiB).

The code is a bit hard to test because its fully usage actually happens
on the receiver where the buffer and its components are not visible.
I'll look to add a test in a follow-up.

cc @djaglowski 

Skipping changelog since #36179 covers it.

---------

Co-authored-by: Daniel Jaglowski <[email protected]>

pkg/stanza/operator/input/windows/bookmark.go

@@ -54,7 +54,7 @@ func (b *Bookmark) Update(event Event) error {
 }
 
 // Render will render the bookmark as xml.
-func (b *Bookmark) Render(buffer Buffer) (string, error) {
+func (b *Bookmark) Render(buffer *Buffer) (string, error) {
 	if b.handle == 0 {
 		return "", fmt.Errorf("bookmark handle is not open")
 	}

pkg/stanza/operator/input/windows/buffer.go

@@ -75,8 +75,8 @@ func (b *Buffer) FirstByte() *byte {
 }
 
 // NewBuffer creates a new buffer with the default buffer size
-func NewBuffer() Buffer {
-	return Buffer{
+func NewBuffer() *Buffer {
+	return &Buffer{
 		buffer: make([]byte, defaultBufferSize),
 	}
 }

pkg/stanza/operator/input/windows/buffer_test.go

@@ -21,17 +21,6 @@ func TestBufferReadBytes(t *testing.T) {
 	require.Equal(t, utf8, bytes)
 }
 
-func TestBufferReadBytesOverflow(t *testing.T) {
-	buffer := NewBuffer()
-	utf8 := []byte("test")
-	utf16, _ := unicode.UTF16(unicode.LittleEndian, unicode.UseBOM).NewEncoder().Bytes(utf8)
-	copy(buffer.buffer, utf16)
-	offset := uint32(len(utf16))
-	bytes, err := buffer.ReadBytes(offset * 2)
-	require.NoError(t, err)
-	require.Equal(t, utf8, bytes)
-}
-
 func TestBufferReadWideBytes(t *testing.T) {
 	buffer := NewBuffer()
 	utf8 := []byte("test")

pkg/stanza/operator/input/windows/event.go

@@ -27,7 +27,7 @@ type Event struct {
 }
 
 // GetPublisherName will get the publisher name of the event.
-func (e *Event) GetPublisherName(buffer Buffer) (string, error) {
+func (e *Event) GetPublisherName(buffer *Buffer) (string, error) {
 	if e.handle == 0 {
 		return "", fmt.Errorf("event handle does not exist")
 	}
@@ -77,7 +77,7 @@ func NewEvent(handle uintptr) Event {
 }
 
 // RenderSimple will render the event as EventXML without formatted info.
-func (e *Event) RenderSimple(buffer Buffer) (*EventXML, error) {
+func (e *Event) RenderSimple(buffer *Buffer) (*EventXML, error) {
 	if e.handle == 0 {
 		return nil, fmt.Errorf("event handle does not exist")
 	}
@@ -100,7 +100,7 @@ func (e *Event) RenderSimple(buffer Buffer) (*EventXML, error) {
 }
 
 // RenderDeep will render the event as EventXML with all available formatted info.
-func (e *Event) RenderDeep(buffer Buffer, publisher Publisher) (*EventXML, error) {
+func (e *Event) RenderDeep(buffer *Buffer, publisher Publisher) (*EventXML, error) {
 	if e.handle == 0 {
 		return nil, fmt.Errorf("event handle does not exist")
 	}

pkg/stanza/operator/input/windows/input.go

@@ -24,7 +24,7 @@ import (
 type Input struct {
 	helper.InputOperator
 	bookmark            Bookmark
-	buffer              Buffer
+	buffer              *Buffer
 	channel             string
 	maxReads            int
 	startAt             string