Do ETW calls take ownership of string pointers?

Question

I have an ETW provider, but the Visual Studio debug CRT is reporting memory leaks in it. The calls to register an event create a wchar_t* on the heap:

    auto msg = convertToWchar(string); // calls new wchar_t[]
    EventWriteBegin (msg);

The EventWriteBegin() function is a macro into the Template_xyz() function that is generated by the ETW compiler:

ULONG
Template_xyz(
    _In_ REGHANDLE RegHandle,
    _In_ PCEVENT_DESCRIPTOR Descriptor,
    _In_opt_ PCWSTR  _Arg0)
{
#define ARGUMENT_COUNT_zdf 1

    EVENT_DATA_DESCRIPTOR EventData[ARGUMENT_COUNT_zdf];

    EventDataDescCreate(&EventData[0], 
                        (_Arg0 != NULL) ? _Arg0 : L"NULL",
                        (_Arg0 != NULL) ? (ULONG)((wcslen(_Arg0) + 1) * sizeof(WCHAR)) : (ULONG)sizeof(L"NULL"));

    return EventWrite(RegHandle, Descriptor, ARGUMENT_COUNT_zdf, EventData);
}

My question is: can I assume that after the PCWSTR argument has been passed to EventDataDescCreate and EventWrite() has been called, can free the string that I pass to it?

The docs for EventDataDescCreate() and EventWrite() don't mention the lifetime semantics for the arguments.

Answer 1

When Windows does take ownership, it will tell you how it will free that memory. That's usually GlobalFree or CoTaskMemFree, never delete[]. That obviously means you need the corresponding allocator instead of new wchar_t[]. Here, no ownership is transferred, so new[]/delete[] is fine.

"Allocated on the heap" is confusing in this context, because it can be interpreted as HeapAlloc, the OS function, instead of new[]