From 3872ddb4655d5925b0890da3f80b2f847f3236ed Mon Sep 17 00:00:00 2001
From: Simon Rozman <simon@rozman.si>
Date: Tue, 25 Oct 2016 13:32:56 +0200
Subject: [PATCH] Zero-length event property data retrieval fixed

---
 include/WinStd/ETW.h | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/include/WinStd/ETW.h b/include/WinStd/ETW.h
index cc337f76..78880a8d 100644
--- a/include/WinStd/ETW.h
+++ b/include/WinStd/ETW.h
@@ -1114,9 +1114,14 @@ inline ULONG TdhGetProperty(_In_ PEVENT_RECORD pEvent, _In_ ULONG TdhContextCoun
     // Query property size.
     ulResult = TdhGetPropertySize(pEvent, TdhContextCount, pTdhContext, PropertyDataCount, pPropertyData, &ulSize);
     if (ulResult == ERROR_SUCCESS) {
-        // Query property value.
-        aData.resize((ulSize + sizeof(_Ty) - 1) / sizeof(_Ty));
-        ulResult = TdhGetProperty(pEvent, TdhContextCount, pTdhContext, PropertyDataCount, pPropertyData, ulSize, reinterpret_cast<LPBYTE>(aData.data()));
+        if (ulSize) {
+            // Query property value.
+            aData.resize((ulSize + sizeof(_Ty) - 1) / sizeof(_Ty));
+            ulResult = TdhGetProperty(pEvent, TdhContextCount, pTdhContext, PropertyDataCount, pPropertyData, ulSize, reinterpret_cast<LPBYTE>(aData.data()));
+        } else {
+            // Property value size is zero.
+            aData.clear();
+        }
     }
 
     return ulResult;