p = strtok(argv[4], ":");  // step 1: it may return null with a malicious input

if (addr_aton(p, &fr->fw_src) < 0) // step 2: pass null to the function addr_aton and dereference the null in the function
	return (-1);