From ad4099ca1794dc44c96f7fc45cafaaa86cfeeb76 Mon Sep 17 00:00:00 2001
From: Alois Kraus <alois.kraus@siemens-healthineers.com>
Date: Tue, 14 May 2024 06:53:28 +0200
Subject: [PATCH] Fix: NullRef in GetClonedChildProcess

---
 ETWAnalyzer/EventDump/DumpObjectRef.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ETWAnalyzer/EventDump/DumpObjectRef.cs b/ETWAnalyzer/EventDump/DumpObjectRef.cs
index a112b2f1..3e5575e5 100644
--- a/ETWAnalyzer/EventDump/DumpObjectRef.cs
+++ b/ETWAnalyzer/EventDump/DumpObjectRef.cs
@@ -667,7 +667,7 @@ ETWProcess GetClonedChildProcess(IHandleDuplicateEvent handleduplicate, IETWExtr
                                                                               x.StartTime < parent.EndTime &&
                                                                               x.StartTime > handleduplicate.GetTime(extract.SessionStart)
                                                                               ).FirstOrDefault();
-                if( child.StartTime > handleduplicate.GetTime(extract.SessionStart))
+                if( child?.StartTime > handleduplicate.GetTime(extract.SessionStart))
                 {
                     lret = child;
                 }