(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/safe-mkstemp.c) |
| |
| 16 | | | safe_mkstemp_full(string_t *prefix, mode_t mode, uid_t uid, gid_t gid, |
| 17 | | | const char *gid_origin) |
| 18 | | | { |
| 19 | | | size_t prefix_len; |
| 20 | | | struct stat st; |
| 21 | | | unsigned char randbuf[8]; |
| 22 | | | mode_t old_umask; |
| 23 | | | int fd; |
| 24 | | | |
| 25 | | | prefix_len = str_len(prefix); |
| 26 | | | for (;;) { |
| 27 | | | do { |
| 28 | | | random_fill_weak(randbuf, sizeof(randbuf)); |
| 29 | | | str_truncate(prefix, prefix_len); |
| 30 | | | str_append(prefix, |
| 31 | | | binary_to_hex(randbuf, sizeof(randbuf))); |
| 32 | [+] | | } while (lstat(str_c(prefix), &st) == 0); |
Event 1:
prefix is passed to str_c().
hide
|
|
 |
| 33 | | | |
| 34 | | | if (errno != ENOENT) {
x /usr/include/asm-generic/errno-base.h |
| |
5 | #define ENOENT 2 /* No such file or directory */ |
| |
|
Event 11:
Skipping " if". errno != 2 evaluates to false.
hide
|
|
| 35 | | | i_error("stat(%s) failed: %m", str_c(prefix)); |
| 36 | | | return -1; |
| 37 | | | } |
| 38 | | | |
| 39 | | | old_umask = umask(0666 ^ mode); |
| 40 | | | fd = open(str_c(prefix), O_RDWR | O_EXCL | O_CREAT, 0666);
x /usr/include/bits/fcntl.h |
| |
39 | #define O_EXCL 0200 /* not fcntl */ |
| |
x /usr/include/bits/fcntl.h |
| |
38 | #define O_CREAT 0100 /* not fcntl */ |
| |
|
| 41 | | | umask(old_umask); |
| 42 | | | if (fd != -1) |
Event 13:
Taking true branch. fd != -1 evaluates to true.
hide
|
|
| 43 | | | break; |
| 44 | | | |
| 45 | | | if (errno != EEXIST) { |
| 46 | | | if (errno != ENOENT && errno != EACCES)
x /usr/include/asm-generic/errno-base.h |
| |
5 | #define ENOENT 2 /* No such file or directory */ |
| |
x /usr/include/asm-generic/errno-base.h |
| |
16 | #define EACCES 13 /* Permission denied */ |
| |
|
| 47 | | | i_error("open(%s) failed: %m", str_c(prefix)); |
| 48 | | | return -1; |
| 49 | | | } |
| 50 | | | } |
| 51 | | | if (uid == (uid_t)-1 && gid == (gid_t)-1) |
Event 14:
Skipping " if". - uid == (uid_t)-1 evaluates to true.
- gid == (gid_t)-1 evaluates to false.
hide
|
|
| 52 | | | return fd; |
| 53 | | | |
| 54 | | | if (fchown(fd, uid, gid) < 0) { |
Event 15:
Taking true branch. fchown(fd, uid, gid) < 0 evaluates to true.
hide
|
|
| 55 | | | if (errno == EPERM) {
x /usr/include/asm-generic/errno-base.h |
| |
4 | #define EPERM 1 /* Operation not permitted */ |
| |
|
Event 16:
Taking true branch. errno == 1 evaluates to true.
hide
|
|
| 56 | | | i_error("%s", eperm_error_get_chgrp("fchown", |
| 57 | | | str_c(prefix), gid, gid_origin)); |
| 58 | | | } else { |
| 59 | | | i_error("fchown(%s, %ld, %ld) failed: %m", |
| 60 | | | str_c(prefix), |
| 61 | | | uid == (uid_t)-1 ? -1L : (long)uid, |
| 62 | | | gid == (gid_t)-1 ? -1L : (long)gid); |
| 63 | | | } |
| 64 | | | (void)close(fd); |
| 65 | [+] | | (void)unlink(str_c(prefix)); |
Event 17:
prefix is passed to str_c().
hide
|
|
 |
| |