From d046e82db6756335ebc92e24d53f353d742370dd Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Mon, 26 Jan 2026 20:49:34 +0100 Subject: [PATCH] detect/flowbits: align pointer in the struct Makes leak sanitizer work without adding LSAN_OPTIONS=use_unaligned=1 Otherwise, leak sanitizer may report rule_id as leaked when it is still owned by some global variable --- src/detect-flowbits.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/detect-flowbits.c b/src/detect-flowbits.c index ecc3899eaa..66c4c2792d 100644 --- a/src/detect-flowbits.c +++ b/src/detect-flowbits.c @@ -1033,10 +1033,10 @@ static bool PrefilterFlowbitIsPrefilterable(const Signature *s) /** core flowbit data structure: map a flowbit id to the signatures that need inspecting after it is * found. Part of a rb-tree. */ typedef struct PrefilterFlowbit { + uint32_t *rule_id; /**< array of signature iid that are part of this prefilter */ uint32_t id; /**< flowbit id */ uint32_t rule_id_size; /**< size in elements of `rule_id` */ uint32_t rule_id_cnt; /**< usage in elements of `rule_id` */ - uint32_t *rule_id; /**< array of signature iid that are part of this prefilter */ RB_ENTRY(PrefilterFlowbit) __attribute__((__packed__)) rb; } __attribute__((__packed__)) PrefilterFlowbit;