{"record":{"id":"1c74e13791fe9cf4","repo":"crowdsecurity/crowdsec","slug":"windows-utf16ptrfromstring-failed-v","errorCode":null,"errorMessage":"windows.UTF16PtrFromString failed: %v","messagePattern":"windows\\.UTF16PtrFromString failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/wineventlog/config_windows.go","lineNumber":121,"sourceCode":"func (s *Source) generateConfig(query string, live bool) (*winlog.SubscribeConfig, error) {\n\tvar config winlog.SubscribeConfig\n\tvar err error\n\n\tif live {\n\t\t// Create a subscription signaler.\n\t\tconfig.SignalEvent, err = windows.CreateEvent(\n\t\t\tnil, // Default security descriptor.\n\t\t\t1,   // Manual reset.\n\t\t\t1,   // Initial state is signaled.\n\t\t\tnil) // Optional name.\n\t\tif err != nil {\n\t\t\treturn &config, fmt.Errorf(\"windows.CreateEvent failed: %v\", err)\n\t\t}\n\t\tconfig.Flags = wevtapi.EvtSubscribeToFutureEvents\n\t} else {\n\t\tconfig.ChannelPath, err = windows.UTF16PtrFromString(s.config.EventFile)\n\t\tif err != nil {\n\t\t\treturn &config, fmt.Errorf(\"windows.UTF16PtrFromString failed: %v\", err)\n\t\t}\n\t\tconfig.Flags = wevtapi.EvtQueryFilePath | wevtapi.EvtQueryForwardDirection\n\t}\n\tconfig.Query, err = windows.UTF16PtrFromString(query)\n\tif err != nil {\n\t\treturn &config, fmt.Errorf(\"windows.UTF16PtrFromString failed: %v\", err)\n\t}\n\n\treturn &config, nil\n}\n\nfunc (s *Source) UnmarshalConfig(yamlConfig []byte) error {\n\ts.config = Configuration{}\n\n\terr := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse wineventlog configuration: %s\", yaml.FormatError(err, false, false))\n\t}","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/wineventlog/config_windows.go#L103-L139","documentation":"`windows.UTF16PtrFromString` failed to convert the configured event file path (or the XPath query string) into a NUL-terminated UTF-16 pointer required by the EVT Win32 API. This happens when the string contains embedded NUL bytes or, for paths, is invalid for conversion — an invalid input configuration rather than an environment failure.","triggerScenarios":"`s.config.EventFile` (from the acquis yaml `event_file`) or the generated XPath `query` contains a NUL character (`\\x00`) or is otherwise not convertible by `UTF16PtrFromString`; a corrupted config value with control characters produces this in `generateConfig`.","commonSituations":"Copy-pasting a Windows path with invisible control characters into the acquisition yaml; generating the path programmatically from a value that already includes a NUL terminator; encoding issues in the yaml that inject stray bytes into the path.","solutions":["Inspect the `event_file` value in the acquisition yaml for invisible/control characters and rewrite it cleanly.","Use a plain forward- or back-slash path without quotes artifacts, e.g. `event_file: C:\\Windows\\System32\\winevt\\Logs\\System.evtx`.","Re-encode the yaml as UTF-8 without BOM/control bytes and reload.","If the query string triggers it, simplify/rewrite the XPath query in the config.","Trim any trailing whitespace/`\\0` if the value is templated from another system."],"exampleFix":"// before\nevent_file: \"C:\\\\Logs\\\\sys.evtx\\x00\"\n// after\nevent_file: C:\\Windows\\System32\\winevt\\Logs\\System.evtx","handlingStrategy":"validation","validationCode":"func validWinString(s string) bool {\n    return s != \"\" && !strings.ContainsRune(s, '\\x00') && utf8.ValidString(s)\n}\n// call before Configure: validWinString(cfg.EventFile)","typeGuard":null,"tryCatchPattern":"p, err := windows.UTF16PtrFromString(path)\nif err != nil {\n    return fmt.Errorf(\"invalid event_file path %q: %v\", path, err)\n}","preventionTips":["Reject NUL/control characters in event_file at config-load time","Keep acquis yaml clean UTF-8, no BOM or control bytes","Type paths manually rather than copy-pasting from terminals","Validate generated queries for embedded NULs before use"],"tags":["windows","wineventlog","config","encoding"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}