microsoft / microsoft/SysmonForLinux
fix: prevent division by zero in intHandler when no events received
Abierto
@MarioHewardt ya está trabajando en esto.
Desde el 4/4/2026.
- Lenguaje dominante
- C
- Estrellas
- 2.2k
- Forks
- 220
- Merge medio
- 11 d 22 h
- PR fusionados (30 d)
- 2
Descripción
Summary
Fix a potential division by zero crash in the intHandler signal
handler when Sysmon is stopped before processing any events
(totalEvents == 0).
Problem
In intHandler(), the following line:
printf("Total events: %ld, bad events: %ld, ratio = %f\n",
totalEvents, badEvents, (double)badEvents / totalEvents);
...will produce a division by zero (resulting in NaN or crash) if
Sysmon is interrupted immediately after startup before any eBPF
events are received.
Fix
Guard the division with a ternary check:
(double)badEvents / totalEvents
→
totalEvents > 0 ? (double)badEvents / totalEvents : 0.0
Testing
- Start Sysmon and immediately send SIGINT (Ctrl+C)
- Confirm clean output showing ratio = 0.000000 instead of crash/NaN
Notes
- No functional change to normal operation
- Zero risk of regression
- Fixes undefined behavior per C standard (integer division by zero)
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Evaluación
Este issue todavía no se ha evaluado.