Skip to content

Conversation

@ckane
Copy link

@ckane ckane commented Nov 5, 2021

Most of the changes here are {0,} -> {{0}} cleanups similar to what's done in microsoft/SysmonForLinux@ea0aa15.

As well, there is one missing cast (converting a signed to unsigned int type). I think that this is fine, but someone else might want to double check the potential values of prevLastEventOffset in this context. It was being tested against ULONG_MAX which threw a warning when the types didn't match.

ckane added 2 commits November 4, 2021 21:20
The existing code threw on error on newer clang and gcc versions where
-Werror was enabled, as the compiler wants a set of brackets present in
the initialization value for each container level in the lvalue's data
type. This change replaces the {0,} initializations with {{0}}, which
satisfies the compiler warnings.
This needs to be an unsigned integer before we can perform the
comparison, in order to satisfy a compiler warning about signedness.
@ckane
Copy link
Author

ckane commented Nov 5, 2021

Might as well drop a mention to microsoft/SysmonForLinux#36 in here, as it contains the related changes to the Linux port of Sysmon.

@kesheldr
Copy link
Contributor

kesheldr commented Nov 8, 2021

This looks good - many thanks. As SysmonCommon is shared, I need to feed this back via a PR into the internal ADO first; when we have approval for that, I'll approve this one here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants