# Buggy code
def GetEntries(self, parser_mediator, registry_key, **kwargs):
    """Extracts event objects from a Application Compatibility Cache key.

    Args:
      parser_mediator: A parser mediator object (instance of ParserMediator).
      registry_key: A Windows Registry key (instance of
                    dfwinreg.WinRegistryKey).
    """
    value = registry_key.GetValueByName("AppCompatCache")
    if not value:
        return

    value_data = value.data
    value_data_size = len(value.data)

    format_type = self._CheckSignature(value_data)
    if not format_type:
        parser_mediator.ProduceParseError(
            "Unsupported signature in AppCompatCache key: {0:s}".format(
                registry_key.path
            )
        )
        return

    header_object = self._ParseHeader(format_type, value_data)

    # On Windows Vista and 2008 when the cache is empty it will
    # only consist of the header.
    if value_data_size <= header_object.header_size:
        return

    cached_entry_offset = header_object.header_size
    cached_entry_size = self._DetermineCacheEntrySize(
        format_type, value_data, cached_entry_offset
    )

    if not cached_entry_size:
        parser_mediator.ProduceParseError(
            "Unsupported cached entry size at offset {0:d} in AppCompatCache "
            "key: {1:s}".format(cached_entry_offset, registry_key.path)
        )
        return

    cached_entry_index = 0
    while cached_entry_offset < value_data_size:
        cached_entry_object = self._ParseCachedEntry(
            format_type, value_data, cached_entry_offset, cached_entry_size
        )

        if cached_entry_object.last_modification_time is not None:
            # TODO: refactor to file modification event.
            event_object = AppCompatCacheEvent(
                cached_entry_object.last_modification_time,
                "File Last Modification Time",
                registry_key.path,
                cached_entry_index + 1,
                cached_entry_object.path,
                cached_entry_offset,
            )
            parser_mediator.ProduceEvent(event_object)

        if cached_entry_object.last_update_time is not None:
            # TODO: refactor to process run event.
            event_object = AppCompatCacheEvent(
                cached_entry_object.last_update_time,
                eventdata.EventTimestamp.LAST_RUNTIME,
                registry_key.path,
                cached_entry_index + 1,
                cached_entry_object.path,
                cached_entry_offset,
            )
            parser_mediator.ProduceEvent(event_object)

        cached_entry_offset += cached_entry_object.cached_entry_size
        cached_entry_index += 1

        if (
            header_object.number_of_cached_entries != 0
            and cached_entry_index >= header_object.number_of_cached_entries
        ):
            break


# Traceback (WinRegistryValueError)
2015-11-27 16:57:21,504 [WARNING] (Worker_01 ) PID:10600 <worker> Unhandled exception while processing path spec: type: OS, location: /home/onager/code/plaso/test_data/SOFTWARE-RunTests
2015-11-27 16:57:21,504 [ERROR] (Worker_01 ) PID:10600 <worker> Unable to read data from value: lParam with error: pyregf_value_get_data_as_integer: unable to retrieve integer value. libregf_value_type_copy_to_32bit: invalid value data size value out of bounds. libregf_value_get_value_32bit: unable to set 32-bit value.
Traceback (most recent call last):
File "/home/onager/code/plaso/plaso/engine/worker.py", line 570, in _ProcessPathSpec
self._ProcessFileEntry(file_entry, data_stream_name=data_stream_name)
File "/home/onager/code/plaso/plaso/engine/worker.py", line 523, in _ProcessFileEntry
self._ProcessDataStream(file_entry, data_stream_name=data_stream_name)
File "/home/onager/code/plaso/plaso/engine/worker.py", line 464, in _ProcessDataStream
parser_object, file_entry, file_object=file_object)
File "/home/onager/code/plaso/plaso/engine/worker.py", line 261, in _ParseFileEntryWithParser
parser_object.Parse(self._parser_mediator, file_object)
File "/home/onager/code/plaso/plaso/parsers/interface.py", line 288, in Parse
self.ParseFileObject(parser_mediator, file_object, **kwargs)
File "/home/onager/code/plaso/plaso/parsers/winreg.py", line 119, in ParseFileObject
parser_mediator, registry_key)
File "/home/onager/code/plaso/plaso/parsers/winreg_plugins/interface.py", line 280, in UpdateChainAndProcess
self.Process(parser_mediator, registry_key, **kwargs)
File "/home/onager/code/plaso/plaso/parsers/winreg_plugins/interface.py", line 265, in Process
self.GetEntries(parser_mediator, registry_key, **kwargs)
File "/home/onager/code/plaso/plaso/parsers/winreg_plugins/default.py", line 50, in GetEntries
registry_value.data_type_string, registry_value.GetData())
File "/home/onager/code/plaso/plaso/dfwinreg/regf.py", line 175, in GetData
self._pyregf_value.name, exception))
WinRegistryValueError: Unable to read data from value: lParam with error: pyregf_value_get_data_as_integer: unable to retrieve integer value. libregf_value_type_copy_to_32bit: invalid value data size value out of bounds. libregf_value_get_value_32bit: unable to set 32-bit value.

# Fixed code
def GetEntries(self, parser_mediator, registry_key, **kwargs):
    """Extracts event objects from a Application Compatibility Cache key.

    Args:
      parser_mediator: A parser mediator object (instance of ParserMediator).
      registry_key: A Windows Registry key (instance of
                    dfwinreg.WinRegistryKey).
    """
    value = registry_key.GetValueByName("AppCompatCache")
    if not value:
        return

    value_data = value.data
    value_data_size = len(value.data)

    format_type = self._CheckSignature(value_data)
    if not format_type:
        parser_mediator.ProduceParseError(
            "Unsupported signature in AppCompatCache key: {0:s}".format(
                registry_key.path
            )
        )
        return

    header_object = self._ParseHeader(format_type, value_data)

    # On Windows Vista and 2008 when the cache is empty it will
    # only consist of the header.
    if value_data_size <= header_object.header_size:
        return

    cached_entry_offset = header_object.header_size
    cached_entry_size = self._DetermineCacheEntrySize(
        format_type, value_data, cached_entry_offset
    )

    if not cached_entry_size:
        parser_mediator.ProduceParseError(
            (
                "Unsupported cached entry size at offset {0:d} in AppCompatCache "
                "key: {1:s}"
            ).format(cached_entry_offset, registry_key.path)
        )
        return

    cached_entry_index = 0
    while cached_entry_offset < value_data_size:
        cached_entry_object = self._ParseCachedEntry(
            format_type, value_data, cached_entry_offset, cached_entry_size
        )

        if cached_entry_object.last_modification_time is not None:
            # TODO: refactor to file modification event.
            event_object = AppCompatCacheEvent(
                cached_entry_object.last_modification_time,
                "File Last Modification Time",
                registry_key.path,
                cached_entry_index + 1,
                cached_entry_object.path,
                cached_entry_offset,
            )
            parser_mediator.ProduceEvent(event_object)

        if cached_entry_object.last_update_time is not None:
            # TODO: refactor to process run event.
            event_object = AppCompatCacheEvent(
                cached_entry_object.last_update_time,
                eventdata.EventTimestamp.LAST_RUNTIME,
                registry_key.path,
                cached_entry_index + 1,
                cached_entry_object.path,
                cached_entry_offset,
            )
            parser_mediator.ProduceEvent(event_object)

        cached_entry_offset += cached_entry_object.cached_entry_size
        cached_entry_index += 1

        if (
            header_object.number_of_cached_entries != 0
            and cached_entry_index >= header_object.number_of_cached_entries
        ):
            break