BOOL
GetEventUserName(IN PEVENTLOGRECORD pelr,
- IN OUT PSID pLastSid,
+ IN OUT PSID *pLastSid,
OUT PWCHAR pszUser) // TODO: Add IN DWORD BufLen
{
PSID pCurrentSid;
if (!IsValidSid(pCurrentSid))
{
- pLastSid = NULL;
+ *pLastSid = NULL;
return FALSE;
}
- else if (pLastSid && EqualSid(pLastSid, pCurrentSid))
+ else if (*pLastSid && EqualSid(*pLastSid, pCurrentSid))
{
return TRUE;
}
}
}
- pLastSid = Success ? pCurrentSid : NULL;
+ *pLastSid = Success ? pCurrentSid : NULL;
return Success;
}
GetTimeFormatW(LOCALE_USER_DEFAULT, 0, &time, NULL, szLocalTime, ARRAYSIZE(szLocalTime));
/* Get the username that generated the event, and filter it */
- lpszUsername = GetEventUserName(pEvlrTmp, pLastSid, szUsername) ? szUsername : szNoUsername;
+ lpszUsername = GetEventUserName(pEvlrTmp, &pLastSid, szUsername) ? szUsername : szNoUsername;
if (!FilterByString(EventLogFilter->Users, lpszUsername))
goto SkipEvent;