id	summary	reporter	owner	description	type	status	milestone	component	version	severity	resolution	keywords	cc
3237	_EventLog__Read has an error in the __EventLog_DecodeDesc Function, Insertions replace unintended variables after %1- %9	BILGUS	Jon	"__EventLog_DecodeDesc uses string replace on Insertion place holders returned from _WinAPI_FormatMessage 
ex. %1, %2, %3, %4, %5, %6, %7, %8, %9, %10, %11, %12
However every instance is replaced therefore The data in %1 is also replaced in %10, %11, %12, %13 etc 
the data in %2 is replaced in %20 %21 etc.

For instance if %1 contains Foo 
%10 becomes Foo0
%11 becomes Foo1
%12 becomes Foo2



The fix is to change 
$sDesc = StringReplace($sDesc, ""%"" & $iI, $aStrings[$iI])
to
$sDesc = StringReplace($sDesc, ""%"" & $iI, $aStrings[$iI],1)



Func __EventLog_DecodeDesc($tEventLog)
	Local $aStrings = __EventLog_DecodeStrings($tEventLog)
	Local $sSource = __EventLog_DecodeSource($tEventLog)
	Local $iEventID = DllStructGetData($tEventLog, ""EventID"")
	Local $sKey = ""HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\"" & $__g_sSourceName_Event & ""\"" & $sSource

	Local $aMsgDLL = StringSplit(_WinAPI_ExpandEnvironmentStrings(RegRead($sKey, ""EventMessageFile"")), "";"")

	Local $iFlags = BitOR($__EVENTLOG_FORMAT_MESSAGE_FROM_HMODULE, $__EVENTLOG_FORMAT_MESSAGE_IGNORE_INSERTS)
	Local $sDesc = """"
	For $iI = 1 To $aMsgDLL[0]
		Local $hDLL = _WinAPI_LoadLibraryEx($aMsgDLL[$iI], $__EVENTLOG_LOAD_LIBRARY_AS_DATAFILE)
		If $hDLL = 0 Then ContinueLoop
		Local $tBuffer = DllStructCreate(""wchar Text[4096]"")
		_WinAPI_FormatMessage($iFlags, $hDLL, $iEventID, 0, $tBuffer, 4096, 0)
		_WinAPI_FreeLibrary($hDLL)
		$sDesc &= DllStructGetData($tBuffer, ""Text"")

	Next

	If $sDesc = """" Then
		For $iI = 1 To $aStrings[0]
			$sDesc &= $aStrings[$iI]
		Next
	Else
		For $iI = 1 To $aStrings[0]

			'''$sDesc = StringReplace($sDesc, ""%"" & $iI, $aStrings[$iI],1);<<<<<<<<<HERE Added as 1st occurrence Bilgus 5-20-2016'''
		Next
	EndIf

	Return StringStripWS($sDesc, $STR_STRIPLEADING + $STR_STRIPTRAILING)
EndFunc   ;==>__EventLog_DecodeDesc"	Bug	closed	3.3.14.3	Standard UDFs	3.3.14.0	None	Fixed