(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/fts-squat/squat-uidlist.c) |
| |
| 1037 | | | int squat_uidlist_rebuild_finish(struct squat_uidlist_rebuild_context *ctx, |
| 1038 | | | bool cancel) |
| 1039 | | | { |
| 1040 | | | const char *temp_path; |
| 1041 | | | int ret = 1; |
| 1042 | | | |
| 1043 | | | if (ctx->list_idx != 0) |
Event 1:
Skipping " if". ctx->list_idx != 0 evaluates to false.
hide
|
|
| 1044 | | | uidlist_rebuild_flush_block(ctx); |
| 1045 | | | if (cancel || ctx->uidlist->corrupted) |
| 1046 | | | ret = 0; |
| 1047 | | | |
| 1048 | [+] | | temp_path = t_strconcat(ctx->uidlist->path, ".tmp", NULL); |
 |
| 1049 | | | if (ret > 0) { |
Event 9:
Skipping " if". ret > 0 evaluates to false.
hide
|
|
| 1050 | | | ctx->build_ctx->build_hdr.indexid = |
| 1051 | | | ctx->uidlist->trie->hdr.indexid; |
| 1052 | | | ctx->build_ctx->build_hdr.count = ctx->new_count; |
| 1053 | | | ctx->build_ctx->build_hdr.link_count = 0; |
| 1054 | | | uidlist_write_block_list_and_header(ctx->build_ctx, ctx->output, |
| 1055 | | | &ctx->new_block_offsets, |
| 1056 | | | &ctx->new_block_end_indexes, |
| 1057 | | | FALSE); |
| 1058 | | | o_stream_seek(ctx->output, 0); |
| 1059 | | | o_stream_send(ctx->output, &ctx->build_ctx->build_hdr, |
| 1060 1070 |  | | [ Lines 1060 to 1070 omitted. ] |
| 1071 | | | } else if (rename(temp_path, ctx->uidlist->path) < 0) { |
| 1072 | | | i_error("rename(%s, %s) failed: %m", |
| 1073 | | | temp_path, ctx->uidlist->path); |
| 1074 | | | ret = -1; |
| 1075 | | | } |
| 1076 | | | ctx->build_ctx->need_reopen = TRUE; |
| 1077 | | | } |
| 1078 | | | |
| 1079 | | | |
| 1080 | | | |
| 1081 | | | squat_uidlist_free_from_memory(ctx->uidlist); |
| 1082 | | | |
| 1083 | | | o_stream_unref(&ctx->output); |
| 1084 | | | if (close(ctx->fd) < 0) |
Event 10:
Skipping " if". close(ctx->fd) < 0 evaluates to false.
hide
|
|
| 1085 | | | i_error("close(%s) failed: %m", temp_path); |
| 1086 | | | |
| 1087 | | | if (ret <= 0) { |
Event 11:
Taking true branch. ret <= 0 evaluates to true.
hide
|
|
| 1088 | | | if (unlink(temp_path) < 0) |
Event 12:
temp_path, which evaluates to NULL, is passed to unlink(). See related event 8.
hide
Null Pointer Dereference
The body of unlink() dereferences temp_path, but it is NULL. The issue can occur if the highlighted code executes. See related event 12. Show: All events | Only primary events |
|
| |