(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/fts-squat/squat-trie.c) |
| |
| 649 | | | node_split_string(struct squat_trie_build_context *ctx, struct squat_node *node) |
| 650 | | | { |
| 651 | | | struct squat_node *child; |
| 652 | | | unsigned char *str; |
| 653 | | | unsigned int uid, idx, leafstr_len = node->leaf_string_length; |
| 654 | | | |
| 655 | | | i_assert(leafstr_len > 0);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 1:
Skipping " if". leafstr_len > 0 evaluates to true.
hide
Event 2:
Skipping " if". !(leafstr_len > 0) evaluates to false.
hide
Event 3:
Skipping " if". !!(leafstr_len > 0) evaluates to true.
hide
Event 4:
Skipping " if". !!!(leafstr_len > 0) evaluates to false.
hide
Event 5:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 656 | | | |
| 657 | | | |
| 658 | | | |
| 659 | | | str = t_malloc(leafstr_len); |
| 660 | | | if (!NODE_IS_DYNAMIC_LEAF(node))
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/fts-squat/squat-trie-private.h |
| |
104 | #define NODE_IS_DYNAMIC_LEAF(node) \ |
105 | ((node)->leaf_string_length > \ |
106 | sizeof((node)->children.static_leaf_string)) |
| |
|
Event 6:
Taking false branch. node->leaf_string_length > sizeof( node->children.static_leaf_string ) evaluates to true.
hide
|
|
| 661 | | | memcpy(str, node->children.static_leaf_string, leafstr_len); |
| 662 | | | else { |
| 663 | | | memcpy(str, node->children.leaf_string, leafstr_len); |
| 664 | | | i_free(node->children.leaf_string);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/imem.h |
| |
14 | #define i_free(mem) \ |
15 | STMT_START { \ |
16 | free(mem); \ |
17 | (mem) = NULL; \ |
18 | } STMT_END |
| |
|
Event 7:
node->children is set to 0. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 665 | | | } |
| 666 | | | node->leaf_string_length = 0; |
| 667 | | | |
| 668 | | | |
| 669 | [+] | | idx = node_add_child(ctx->trie, node, str[0], MAX_FAST_LEVEL); |
Event 8:
node is passed to node_add_child() as the second argument.
hide
|
|
 |
| |