(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/ostream-file.c) |
| |
| 701 | | | static off_t io_stream_copy_backwards(struct ostream_private *outstream, |
| 702 | | | struct istream *instream, uoff_t in_size) |
| 703 | | | { |
| 704 | | | struct file_ostream *foutstream = (struct file_ostream *)outstream; |
| 705 | | | uoff_t in_start_offset, in_offset, in_limit, out_offset; |
| 706 | | | const unsigned char *data; |
| 707 | | | size_t buffer_size, size, read_size; |
| 708 | | | ssize_t ret; |
| 709 | | | |
| 710 | | | i_assert(IS_STREAM_EMPTY(foutstream));
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/ostream-file.c |
| |
25 | #define IS_STREAM_EMPTY(fstream) \ |
26 | ((fstream)->head == (fstream)->tail && !(fstream)->full) |
| |
|
Event 1:
Skipping " if". - foutstream->head == foutstream->tail evaluates to true.
- foutstream->full evaluates to false.
hide
Event 2:
Skipping " if". !(foutstream->head == foutstream->tail && !foutstream->full) evaluates to false.
hide
Event 3:
Skipping " if". !!(foutstream->head == foutstream->tail && !foutstream->full) evaluates to true.
hide
Event 4:
Skipping " if". !!!(foutstream->head == foutstream->tail && !foutstream->full) evaluates to false.
hide
Event 5:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 711 | | | |
| 712 | | | |
| 713 | | | buffer_size = instream->real_stream->buffer_size; |
| 714 | | | if (buffer_size == 0 || buffer_size > foutstream->buffer_size) { |
Event 6:
Taking true branch. buffer_size == 0 evaluates to true.
hide
|
|
| 715 | | | if (foutstream->optimal_block_size > foutstream->buffer_size) { |
Event 7:
Skipping " if". foutstream->optimal_block_size > foutstream->buffer_size evaluates to false.
hide
|
|
| 716 | | | o_stream_grow_buffer(foutstream, |
| 717 | | | foutstream->optimal_block_size - |
| 718 | | | foutstream->buffer_size); |
| 719 | | | } |
| 720 | | | |
| 721 | | | buffer_size = foutstream->buffer_size; |
| 722 | | | } |
| 723 | | | |
| 724 | | | in_start_offset = instream->v_offset; |
| 725 | | | in_offset = in_limit = in_size; |
| 726 | | | out_offset = outstream->ostream.offset + (in_offset - in_start_offset); |
| 727 | | | |
| 728 | | | while (in_offset > in_start_offset) { |
Event 8:
Entering loop body. in_offset > in_start_offset evaluates to true.
hide
|
|
| 729 | | | if (in_offset - in_start_offset <= buffer_size) |
Event 9:
Taking true branch. in_offset - in_start_offset <= buffer_size evaluates to true.
hide
|
|
| 730 | | | read_size = in_offset - in_start_offset; |
| 731 | | | else |
| 732 | | | read_size = buffer_size; |
| 733 | | | in_offset -= read_size; |
| 734 | | | out_offset -= read_size; |
| 735 | | | |
| 736 | | | for (;;) { |
| 737 | | | i_assert(in_offset <= in_limit);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 10:
Skipping " if". in_offset <= in_limit evaluates to true.
hide
Event 11:
Skipping " if". !(in_offset <= in_limit) evaluates to false.
hide
Event 12:
Skipping " if". !!(in_offset <= in_limit) evaluates to true.
hide
Event 13:
Skipping " if". !!!(in_offset <= in_limit) evaluates to false.
hide
Event 14:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 738 | | | |
| 739 | | | i_stream_seek(instream, in_offset); |
| 740 | | | read_size = in_limit - in_offset; |
| 741 | | | |
| 742 | | | (void)i_stream_read_data(instream, &data, &size, |
Event 15:
&data is passed to i_stream_read_data() as the second argument.
hide
|
|
| 743 | [+] | | read_size-1); |
 |
| 744 | | | if (size >= read_size) { |
Event 21:
Taking true branch. size >= read_size evaluates to true.
hide
|
|
| 745 | | | size = read_size; |
| 746 | | | if (instream->mmaped) { |
Event 22:
Taking true branch. instream->mmaped evaluates to true.
hide
|
|
| 747 | | | |
| 748 | | | |
| 749 | | | i_assert(size <=
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 750 | | | foutstream->buffer_size); |
Event 23:
Skipping " if". size <= foutstream->buffer_size evaluates to true.
hide
Event 24:
Skipping " if". !(size <= foutstream->buffer_size) evaluates to false.
hide
Event 25:
Skipping " if". !!(size <= foutstream->buffer_size) evaluates to true.
hide
Event 26:
Skipping " if". !!!(size <= foutstream->buffer_size) evaluates to false.
hide
Event 27:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 751 | | | memcpy(foutstream->buffer, data, size); |
Event 28:
data, which evaluates to NULL, is passed to memcpy() as the second argument. See related event 19.
hide
Null Pointer Dereference
The body of memcpy() dereferences data, but it is NULL. The issue can occur if the highlighted code executes. See related event 28. Show: All events | Only primary events |
|
| |