[FIX] Prevent infinite loop parsing when record has a corrupted size

[maxspl]

Hi,

I've encountered an issue with evtx records that have a corrupted data_size field. This causes an infinite loop.

I can't provide the evtx records, but here is the debug output:

09:47:09 [INFO] Record id - 0
09:47:09 [DEBUG] (14) evtx::evtx_chunk: Record header - EvtxRecordHeader { data_size: 3099113656, event_record_id: 0, timestamp: 1601-01-01T00:00:00Z }
09:47:09 [INFO] Record id - 0
09:47:09 [DEBUG] (14) evtx::evtx_chunk: Record header - EvtxRecordHeader { data_size: 3099113656, event_record_id: 0, timestamp: 1601-01-01T00:00:00Z }
09:47:09 [INFO] Record id - 0
09:47:09 [DEBUG] (14) evtx::evtx_chunk: Record header - EvtxRecordHeader { data_size: 3099113656, event_record_id: 0, timestamp: 1601-01-01T00:00:00Z }
09:47:09 [INFO] Record id - 0

The fix allows skipping the chunk and exiting the infinite loop.

Thanks in advance :)