From f0483f308a4daed188deee776aa7a7a733293642 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 27 Apr 2026 02:04:38 +0900 Subject: [PATCH] format-table: fix potential segfault In format-table.h, TABLE_IN_ADDR is commented as "Takes a union in_addr_union (or a struct in_addr)". However, if we pass struct in_addr to table_add_many(), the function reads more than the size of the struct. --- src/shared/format-table.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/shared/format-table.c b/src/shared/format-table.c index 432e054d4a..f678a6722c 100644 --- a/src/shared/format-table.c +++ b/src/shared/format-table.c @@ -1081,12 +1081,12 @@ int table_add_many_internal(Table *t, TableDataType first_type, ...) { break; case TABLE_IN_ADDR: - buffer.address = *va_arg(ap, union in_addr_union *); + buffer.address.in = *va_arg(ap, struct in_addr *); data = &buffer.address.in; break; case TABLE_IN6_ADDR: - buffer.address = *va_arg(ap, union in_addr_union *); + buffer.address.in6 = *va_arg(ap, struct in6_addr *); data = &buffer.address.in6; break;