(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-index/mail-index-fsck.c) |
| |
| 129 | | | mail_index_fsck_keywords(struct mail_index *index, struct mail_index_map *map, |
| 130 | | | struct *hdr, |
| 131 | | | const struct *ext_hdr, |
| 132 | | | unsigned int ext_offset, unsigned int *offset_p) |
| 133 | | | { |
| 134 | | | const struct *kw_hdr; |
| 135 | | | struct *new_kw_hdr; |
| 136 | | | const struct *kw_rec; |
| 137 | | | struct new_kw_rec; |
| 138 | | | const char *name, *name_buffer, **name_array; |
| 139 | | | unsigned int i, j, name_pos, name_size, rec_pos, hdr_offset, diff; |
| 140 | | | unsigned int changed_count, keywords_count, name_base_pos; |
| 141 | | | ARRAY_TYPE(const_string) names; |
| 142 | | | buffer_t *dest; |
| 143 | | | bool changed = FALSE; |
| 144 | | | |
| 145 | | | hdr_offset = ext_offset + |
| 146 | | | mail_index_map_ext_hdr_offset(sizeof(MAIL_INDEX_EXT_KEYWORDS)-1); |
| 147 | | | kw_hdr = CONST_PTR_OFFSET(map->hdr_base, hdr_offset);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
| 148 | | | keywords_count = kw_hdr->keywords_count; |
| 149 | | | |
| 150 | | | kw_rec = (const void *)(kw_hdr + 1); |
| 151 | | | name_buffer = (const char *)(kw_rec + keywords_count); |
| 152 | | | |
| 153 | | | name_pos = (size_t)(name_buffer - (const char *)kw_hdr); |
| 154 | | | if (name_pos > ext_hdr->hdr_size) { |
Event 1:
Taking false branch. name_pos > ext_hdr->hdr_size evaluates to false.
hide
|
|
| 155 | | | |
| 156 | | | keywords_count = |
| 157 | | | mail_index_fsck_find_keyword_count(map, ext_hdr); |
| 158 | | | mail_index_fsck_error(index, "Assuming keywords_count = %u", |
| 159 | | | keywords_count); |
| 160 | | | kw_rec = NULL; |
| 161 | | | name_size = 0; |
| 162 | | | changed = TRUE; |
| 163 | | | } else { |
| 164 | | | name_size = ext_hdr->hdr_size - name_pos; |
| 165 | | | } |
| 166 | | | |
| 167 | | | |
| 168 | | | |
| 169 | | | t_array_init(&names, keywords_count);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
39 | #define t_array_init(array, init_count) \ |
40 | p_array_init(array, pool_datastack_create(), init_count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
35 | #define p_array_init(array, pool, init_count) \ |
36 | array_create(array, pool, sizeof(**(array)->v), init_count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
75 | #define array_create(array, pool, element_size, init_count) \ |
76 | array_create_i(&(array)->arr, pool, element_size, init_count) |
| |
|
| 170 | | | for (i = 0; i < keywords_count; i++) { |
| 171 | | | if (name_size == 0 || |
| 172 | | | !keyword_name_is_valid(name_buffer, kw_rec[i].name_offset, |
| 173 | | | name_size)) |
| 174 | | | name = ""; |
| 175 | | | else |
| 176 | | | name = name_buffer + kw_rec[i].name_offset; |
| 177 | | | |
| 178 | | | if (*name != '\0' && array_has_name(&names, name)) { |
| 179 | | | |
| 180 | | | name = ""; |
| 181 | | | } |
| 182 | | | array_append(&names, &name, 1);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
116 | #define array_append(array, data, count) \ |
117 | array_append_i(&(array)->arr + ARRAY_TYPE_CHECK(array, data), \ |
118 | data, count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
47 | # define ARRAY_TYPE_CHECK(array, data) \ |
48 | COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE( \ |
49 | **(array)->v_modifiable, *data) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
158 | # define COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(_a, _b) \ |
159 | COMPILE_ERROR_IF_TRUE( \ |
160 | !__builtin_types_compatible_p(typeof(_a), typeof(_b))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
156 | # define COMPILE_ERROR_IF_TRUE(condition) \ |
157 | (sizeof(char[1 - 2 * !!(condition)]) - 1) |
| |
|
| 183 | | | } |
| 184 | | | |
| 185 | | | |
| 186 | | | changed_count = 0; |
| 187 | | | name_array = array_idx_modifiable(&names, 0);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
179 | #define array_idx_modifiable(array, idx) \ |
180 | ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
181 | array_idx_modifiable_i(&(array)->arr, idx) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
45 | # define ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
46 | (typeof(*(array)->v_modifiable)) |
| |
|
| 188 | | | for (i = j = 0; i < keywords_count; i++) { |
| 189 | | | while (name_array[i][0] == '\0') { |
| 190 | | | name = t_strdup_printf("unknown-%d", j++); |
| 191 | | | if (!array_has_name(&names, name)) { |
| 192 | | | name_array[i] = name; |
| 193 | | | changed = TRUE; |
| 194 | | | changed_count++; |
| 195 | | | } |
| 196 | | | } |
| 197 | | | } |
| 198 | | | |
| 199 | | | if (!changed) { |
Event 4:
Skipping " if". changed evaluates to true.
hide
|
|
| 200 | | | |
| 201 | | | return; |
| 202 | | | } |
| 203 | | | |
| 204 | | | mail_index_fsck_error(index, "Renamed %u keywords to unknown-*", |
| 205 | | | changed_count); |
| 206 | | | |
| 207 | | | dest = buffer_create_dynamic(default_pool, |
| 208 | | | I_MAX(ext_hdr->hdr_size, 128)); |
Event 5:
ext_hdr->hdr_size > 128 evaluates to false.
hide
|
|
| 209 | | | new_kw_hdr = buffer_append_space_unsafe(dest, sizeof(*new_kw_hdr)); |
| 210 | | | new_kw_hdr->keywords_count = keywords_count; |
| 211 | | | |
| 212 | | | |
| 213 | | | rec_pos = dest->used; |
| 214 | | | memset(&new_kw_rec, 0, sizeof(new_kw_rec)); |
| 215 | | | buffer_append_space_unsafe(dest, keywords_count * sizeof(*kw_rec)); |
| 216 | | | |
| 217 | | | |
| 218 | | | name_base_pos = dest->used; |
| 219 | | | for (i = 0; i < keywords_count; i++) { |
| 220 | | | new_kw_rec.name_offset = dest->used - name_base_pos; |
| 221 | | | buffer_write(dest, rec_pos, &new_kw_rec, sizeof(new_kw_rec)); |
| 222 | | | rec_pos += sizeof(*kw_rec); |
| 223 | | | |
| 224 | | | buffer_append(dest, name_array[i], strlen(name_array[i]) + 1); |
| 225 | | | } |
| 226 | | | |
| 227 | | | |
| 228 | | | if (dest->used < ext_hdr->hdr_size) |
Event 7:
Skipping " if". dest->used < ext_hdr->hdr_size evaluates to false.
hide
|
|
| 229 | | | buffer_append_zero(dest, ext_hdr->hdr_size - dest->used); |
| 230 | | | |
| 231 | | | if (dest->used > ext_hdr->hdr_size) { |
Event 8:
Taking true branch. dest->used > ext_hdr->hdr_size evaluates to true.
hide
|
|
| 232 | | | |
| 233 | | | struct new_ext_hdr; |
| 234 | | | |
| 235 | | | diff = dest->used - ext_hdr->hdr_size; |
| 236 | | | buffer_copy(map->hdr_copy_buf, hdr_offset + diff, |
| 237 | [+] | | map->hdr_copy_buf, hdr_offset, (size_t)-1); |
Event 9:
-1 is passed to buffer_copy() as the fifth argument. - Determines the size in the Unreasonable Size Argument warning later.
hide
|
|
 |
| |