Velocidex/velociraptor: file_store/result_sets/events.go; 109 LoC

Found a possible issue in [Velocidex/velociraptor](https://www.github.com/Velocidex/velociraptor) at [file_store/result_sets/events.go](https://github.com/Velocidex/velociraptor/blob/c4716f0da68746ad84c46c244dc387d9e78798d2/file_store/result_sets/events.go#L88-L196)

Below is the message reported by the analyzer for this snippet of code. Beware that the analyzer only reports the first
issue it finds, so please do not limit your consideration to the contents of the below message.

> range-loop variable prop used in defer or goroutine at line 122

[Click here to see the code in its original context.](https://github.com/Velocidex/velociraptor/blob/c4716f0da68746ad84c46c244dc387d9e78798d2/file_store/result_sets/events.go#L88-L196)

Click here to show the 109 line(s) of Go which triggered the analyzer.

```go
for prop := range path_manager.GeneratePaths(ctx) {
// Is this part entirely before the required range? If
// so skip the entire part.
if start_time > 0 && uint64(prop.EndTime) <= start_time {
continue
}

// Have we found the start cursor? If so and this part
// fits entirely inside the required range just add
// the whole file.
if len(result) > 0 && uint64(prop.EndTime) <= end_time {
result = append(result, &Cursor{
Timestamp: uint64(prop.StartTime),
Filename: prop.Path,
TotalRows: getNumberOfRowsInFile(
ctx, file_store_factory, prop.Path),
})
continue
}

// FIXME - for now this is not efficient - we open the
// result set and read every row until we find the one
// with a time larger than we need. This could be
// improved by having a second timestamp index on the
// result set.
fd, err := file_store_factory.ReadFile(prop.Path)
if err != nil {
continue
}
defer fd.Close()

count := uint64(0)
defer func() {
fmt.Printf("(%v, %v): Brute force counted %v rows in %v\n",
start_time, end_time, count, prop)
}()

rs_reader := &ResultSetReaderImpl{fd: fd}
for item := range rs_reader.Rows(ctx) {
ts := uint64(utils.GetInt64(item, "_ts"))

// If we have not found the start yet and this
// row's timestamp is after the required
// start, then we add a start cursor to it.
if current_cursor == nil {
// Row is earlier than required, skip it.
if ts < start_time {
count++
continue
}

// Create a new cursor - it can
// represent the rest of this part, or
// a sub range within this part.
current_cursor = &Cursor{
Timestamp: uint64(ts),
RowIdx: count,
Filename: prop.Path,
}

// This part ends before the required
// range so add it completely, and
// go to the next file.
if uint64(prop.EndTime) <= end_time {
current_cursor.TotalRows = getNumberOfRowsInFile(
ctx, file_store_factory, prop.Path) - count
result = append(result, current_cursor)
current_cursor = nil
break
}
}

// If the row timestamp exceeds the required
// range and we are still working on a cursor,
// then complete the cursor and finish this
// function.
if ts >= end_time {

// We already started a cursor, finish
// it and return.
if current_cursor != nil {
current_cursor.TotalRows = count - current_cursor.RowIdx
result = append(result, current_cursor)
return result
}

// Otherwise just add a new cursor
// that covers this file up to the
// current row.
result = append(result, &Cursor{
Timestamp: uint64(prop.StartTime),
RowIdx: 0,
Filename: prop.Path,
TotalRows: count,
})
return result
}

// Keep counting the rows until we exceed the
// required range.
count++
}

if current_cursor != nil {
current_cursor.TotalRows = count
result = append(result, current_cursor)
current_cursor = nil
}
}

```

Leave a reaction on this issue to contribute to the project by classifying this instance as a **Bug** :-1:, **Mitigated** :+1:, or **Desirable Behavior** :rocket:
See the descriptions of the classifications [here](https://github.com/github-vet/rangeclosure-findings#how-can-i-help) for more information.

commit ID: c4716f0da68746ad84c46c244dc387d9e78798d2