More general solution for handling when property Flags are set on EVENT_PROPERTY_INFO.

1) If flags are not set, try to get the length from the property 'length' field. Otherwise, try the heuristic.
2) if we couldn't get a length, fall back to calling TDH.

Signed-off-by: Zac Brown (ODSP SECURITY) <zbrown@microsoft.com>

krabs/krabs/size_provider.hpp

@@ -69,9 +69,19 @@ namespace krabs {
         }
 
         ULONG propertyLength = 0;
-        propertyLength = get_heuristic_size(propertyStart, propertyInfo);
 
-        // didn't have a heuristic for size, ask Tdh
+        // If no flags are set on the property, attempt to use the length
+        // field. If that field is 0, try using our heuristic.
+        if (propertyInfo.Flags == 0)
+        {
+            if (propertyInfo.length > 0)
+                propertyLength = propertyInfo.length;
+            else
+                propertyLength = get_heuristic_size(propertyStart, propertyInfo);
+        }
+
+        // Couldn't get the length from the 'length' field or
+        // the heuristic for size failed -> ask Tdh.
         if (propertyLength == 0)
             propertyLength = get_tdh_size(propertyName, record);
 
@@ -89,10 +99,6 @@ namespace krabs {
         // The following _very_ common property types can be short-circuited
         // to prevent the expensive call.
 
-        // We don't handle array types for heuristic sizing.
-        if (propertyInfo.Flags & PropertyParamCount)
-            return propertyLength;
-
         // Be careful! Check IN and OUT types before making an assumption.
 
         if (propertyInfo.nonStructType.OutType == TDH_OUTTYPE_STRING)