From b0093dc7609f66814104d88483fdd4cfa1bdcd2a Mon Sep 17 00:00:00 2001 From: Chris Yang Date: Tue, 31 Mar 2026 18:20:02 -0400 Subject: [PATCH] fix(userspace/sysdig): prevent integer underflow when an event with a timestamp prior to duration_start is logged while using '-M' CLI flag Signed-off-by: Chris Yang --- userspace/sysdig/sysdig.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/userspace/sysdig/sysdig.cpp b/userspace/sysdig/sysdig.cpp index f02c5c6780..ba9ff45dcb 100644 --- a/userspace/sysdig/sysdig.cpp +++ b/userspace/sysdig/sysdig.cpp @@ -817,7 +817,8 @@ captureinfo do_inspect(sinsp *inspector, sinsp_cycledumper *dumper, duration_start = ev->get_ts(); } else if(duration_to_tot_ns > 0) { - if(ev->get_ts() - duration_start >= duration_to_tot_ns) + if(ev->get_ts() > duration_start && + ev->get_ts() - duration_start >= duration_to_tot_ns) { handle_end_of_file(inspector, print_progress, reset_colors, formatter); break;