diff --git a/tests/test_evtlog.py b/tests/test_evtlog.py index 9dcd510..c0128df 100644 --- a/tests/test_evtlog.py +++ b/tests/test_evtlog.py @@ -99,6 +99,18 @@ def test_evthandle_close(): memory_usage_in_mo = (post_usage - start_usage) / 1024 / 1024 assert memory_usage_in_mo <= 0.5 +def test_evtrender_evthandle_close(): + start_usage = windows.current_process.memory_info.PrivateUsage + chan = windows.system.event_log["System"] + query = chan.query() + evt = next(query) + for i in range(0x10000): + x = evt.opcode + post_usage = windows.current_process.memory_info.PrivateUsage + memory_usage_in_mo = (post_usage - start_usage) / 1024 / 1024 + # Use ~20MO if render are leaking + assert memory_usage_in_mo <= 0.5 + tscheduler = windows.system.task_scheduler troot = tscheduler.root diff --git a/windows/winobject/event_log.py b/windows/winobject/event_log.py index 267273d..7072264 100644 --- a/windows/winobject/event_log.py +++ b/windows/winobject/event_log.py @@ -11,6 +11,7 @@ from windows.pycompat import int_types, basestring # Helpers + @contextmanager def ClosingEvtHandle(handle): try: @@ -183,17 +184,20 @@ class EvtEvent(EvtHandle): # Each value wil return 1 node :) ctx = windows.winproxy.EvtCreateRenderContext(nbelt, pwstr_rarray, gdef.EvtRenderContextValues) result = self.render(ctx, gdef.EvtRenderEventValues) + windows.winproxy.EvtClose(ctx) return [r.value for r in result] def system_values(self): # POC: use this for all @property based on system data ? ctx = windows.winproxy.EvtCreateRenderContext(0, None, gdef.EvtRenderContextSystem) result = self.render(ctx, gdef.EvtRenderEventValues) + windows.winproxy.EvtClose(ctx) return [r.value for r in result] def event_values(self): """The values of the event in a list""" ctx = windows.winproxy.EvtCreateRenderContext(0, None, gdef.EvtRenderContextUser) result = self.render(ctx, gdef.EvtRenderEventValues) + windows.winproxy.EvtClose(ctx) return [r.value for r in result] def get_raw_values(self, values, flags=gdef.EvtRenderContextValues): @@ -205,6 +209,7 @@ class EvtEvent(EvtHandle): # Each value will return 1 node :) ctx = windows.winproxy.EvtCreateRenderContext(nbelt, pwstr_rarray, gdef.EvtRenderContextValues) result = self.render(ctx, gdef.EvtRenderEventValues) + windows.winproxy.EvtClose(ctx) return list(result)