(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-index/mail-cache-fields.c) |
| |
| 259 | | | int (struct mail_cache *cache) |
| 260 | | | { |
| 261 | | | const struct *field_hdr = NULL; |
| 262 | | | struct mail_cache_field field; |
| 263 | | | const uint32_t *last_used, *sizes; |
| 264 | | | const uint8_t *types, *decisions; |
| 265 | | | const char *p, *names, *end; |
| 266 | | | void *orig_key, *orig_value; |
| 267 | | | unsigned int fidx, new_fields_count; |
| 268 | | | enum mail_cache_decision_type dec; |
| 269 | | | time_t max_drop_time; |
| 270 | | | uint32_t offset, i; |
| 271 | | | |
| 272 | [+] | | if ((cache, &offset, TRUE) < 0) |
Event 1:
Skipping " if". !0 evaluates to true.
hide
|
|
 |
| 273 | | | return -1; |
| 274 | | | |
| 275 | | | if (offset == 0) { |
Event 17:
Skipping " if". offset == 0 evaluates to false.
hide
|
|
| 276 | | | |
| 277 | | | return 0; |
| 278 | | | } |
| 279 | | | |
| 280 | | | field_hdr = CONST_PTR_OFFSET(cache->data, offset);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
| 281 | | | if (offset + field_hdr->size > cache->mmap_length) { |
Event 18:
Skipping " if". offset + field_hdr->size > cache->mmap_length evaluates to false.
hide
|
|
| 282 | | | mail_cache_set_corrupted(cache, |
| 283 | | | "field points outside file"); |
| 284 | | | return -1; |
| 285 | | | } |
| 286 | | | |
| 287 | | | |
| 288 | | | |
| 289 | | | if (field_hdr->size < sizeof(*field_hdr) + |
| 290 | | | field_hdr->fields_count * (sizeof(uint32_t)*2 + 1 + 2)) { |
Event 19:
Skipping " if". field_hdr->size < sizeof( *field_hdr ) + field_hdr->fields_count * (sizeof( uint32_t ) * 2 + 1 + 2) evaluates to false.
hide
|
|
| 291 | | | mail_cache_set_corrupted(cache, "invalid field size"); |
| 292 | | | return -1; |
| 293 | | | } |
| 294 | | | |
| 295 | | | field_hdr = CONST_PTR_OFFSET(cache->data, offset);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
Event 20:
field_hdr is set to an unknown [ ?unknown: the analysis lost precision when tracking this value, so this warning may be a false positive] value . - Determines the allocation size later.
hide
|
|
| 296 | | | new_fields_count = field_hdr->fields_count; |
Event 21:
new_fields_count is set to field_hdr->fields_count, which evaluates to the value assigned to field_hdr->fields_count at mail-cache-fields.c:295. See related event 20.
hide
|
|
| 297 | | | |
| 298 | | | if (new_fields_count != 0) { |
Event 22:
Taking true branch. new_fields_count != 0 evaluates to true.
hide
|
|
| 299 | | | cache->file_field_map = |
| 300 | | | i_realloc(cache->file_field_map, |
| 301 | | | cache->file_fields_count * |
| 302 | | | sizeof(unsigned int), |
| 303 | [+] | | new_fields_count * sizeof(unsigned int)); |
Event 23:
4 * new_fields_count, which evaluates to the value assigned to field_hdr->fields_count at mail-cache-fields.c:295, times 4, is passed to i_realloc() as the third argument. - This multiplication may overflow and it is used as the allocation size later.
See related event 21.
hide
|
|
 |
| |