(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-settings/settings.c) |
| |
| 91 | | | settings_read_real(const char *path, const char *section, |
| 92 | | | settings_callback_t *callback, |
| 93 | | | settings_section_callback_t *sect_callback, void *context) |
| 94 | | | { |
| 95 | | | |
| 96 | | | struct input_stack root, *input, *new_input; |
| 97 | | | const char *errormsg, *next_section, *name, *last_section_path = NULL; |
| 98 | | | char *line, *key, *p, quote; |
| 99 | | | string_t *full_line; |
| 100 | | | size_t len; |
| 101 | | | int fd, last_section_line = 0, skip, sections, root_section; |
| 102 | | | |
| 103 | | | fd = open(path, O_RDONLY); |
| 104 | | | if (fd < 0) { |
Event 2:
Skipping " if". fd < 0 evaluates to false.
hide
|
|
| 105 | | | i_error("Can't open configuration file %s: %m", path); |
| 106 | | | return FALSE; |
| 107 | | | } |
| 108 | | | |
| 109 | | | if (section == NULL) { |
Event 3:
Taking true branch. section == (void *)0 evaluates to true.
hide
|
|
| 110 | | | skip = 0; |
| 111 | | | next_section = NULL; |
| 112 | | | } else { |
| 113 | | | skip = 1; |
| 114 | | | next_section = t_strcut(section, '/'); |
| 115 | | | } |
| 116 | | | |
| 117 | | | memset(&root, 0, sizeof(root)); |
| 118 | | | root.path = path; |
| 119 | | | input = &root; |
| 120 | | | |
| 121 | | | full_line = t_str_new(512); |
| 122 | | | sections = 0; root_section = 0; errormsg = NULL; |
| 123 | | | newfile: |
| 124 | | | input->input = i_stream_create_fd(fd, 2048, TRUE); |
Event 4:
!0 evaluates to true.
hide
|
|
| 125 | | | i_stream_set_return_partial_line(input->input, TRUE); |
Event 5:
!0 evaluates to true.
hide
|
|
| 126 | | | prevfile: |
| 127 | | | while ((line = i_stream_read_next_line(input->input)) != NULL) { |
Event 7:
Entering loop body. (line = i_stream_read_next_line(...)) != (void *)0 evaluates to true.
hide
|
|
| 128 | | | input->linenum++; |
| 129 | | | |
| 130 | | | |
| 131 | | | |
| 132 | | | |
| 133 | | | while (IS_WHITE(*line)) |
| 134 | | | line++; |
| 135 | | | |
| 136 | | | |
| 137 | | | if (*line == '#' || *line == '\0') |
Event 9:
Skipping " if". - *line == 35 evaluates to false.
- *line == 0 evaluates to false.
hide
|
|
| 138 | | | continue; |
| 139 | | | |
| 140 | | | |
| 141 | | | for (p = line; *p != '\0'; p++) { |
| 142 | | | if (*p == '\'' || *p == '"') { |
| 143 | | | quote = *p; |
| 144 | | | for (p++; *p != quote && *p != '\0'; p++) { |
| 145 | | | if (*p == '\\' && p[1] != '\0') |
| 146 | | | p++; |
| 147 | | | } |
| 148 | | | if (*p == '\0') |
| 149 | | | break; |
| 150 | | | } else if (*p == '#') { |
| 151 | | | *p = '\0'; |
| 152 | | | break; |
| 153 | | | } |
| 154 | | | } |
| 155 | | | |
| 156 | | | |
| 157 | | | len = strlen(line); |
| 158 | | | while (IS_WHITE(line[len-1])) |
| 159 | | | len--; |
| 160 | | | line[len] = '\0'; |
| 161 | | | |
| 162 | | | if (len > 0 && line[len-1] == '\\') { |
Event 13:
Skipping " if". - len > 0 evaluates to true.
- line[len - 1] == 92 evaluates to false.
hide
|
|
| 163 | | | |
| 164 | | | line[len-1] = '\0'; |
| 165 | | | str_append(full_line, line); |
| 166 | | | continue; |
| 167 | | | } |
| 168 | | | if (str_len(full_line) > 0) { |
Event 14:
Skipping " if". str_len(full_line) > 0 evaluates to false.
hide
|
|
| 169 | | | str_append(full_line, line); |
| 170 | | | line = str_c_modifiable(full_line); |
| 171 | | | } |
| 172 | | | |
| 173 | | | |
| 174 | | | |
| 175 | | | |
| 176 | | | key = line; |
| 177 | | | while (!IS_WHITE(*line) && *line != '\0' && *line != '=') |
| 178 | | | line++; |
| 179 | | | if (IS_WHITE(*line)) { |
Event 16:
Skipping " if". - *line == 32 evaluates to false.
- *line == 9 evaluates to false.
hide
|
|
| 180 | | | *line++ = '\0'; |
| 181 | | | while (IS_WHITE(*line)) line++; |
| 182 | | | } |
| 183 | | | |
| 184 | | | if (strcmp(key, "!include_try") == 0 || |
Event 17:
Taking true branch. strcmp(...) == 0 evaluates to true.
hide
|
|
| 185 | | | strcmp(key, "!include") == 0) { |
| 186 | | | struct input_stack *tmp; |
| 187 | | | const char *path; |
| 188 | | | |
| 189 | | | path = fix_relative_path(line, input); |
| 190 | | | for (tmp = input; tmp != NULL; tmp = tmp->prev) { |
Event 18:
Entering loop body. tmp != (void *)0 evaluates to true.
hide
|
|
| 191 | | | if (strcmp(tmp->path, path) == 0) |
Event 20:
Taking true branch. strcmp(tmp->path, path) == 0 evaluates to true.
hide
|
|
| 192 | | | break; |
| 193 | | | } |
| 194 | | | if (tmp != NULL) { |
Null Test After Dereference
This code tests the nullness of tmp, which has already been dereferenced. - If tmp were null, there would have been a prior null pointer dereference at settings.c:191, and potentially at other locations as well.
- Either this test is redundant, or the earlier dereference(s) should be guarded by a similar test.
The issue can occur if the highlighted code executes. See related event 19. Show: All events | Only primary events |
|
| 195 | | | errormsg = "Recursive include"; |
| 196 | | | } else if ((fd = open(path, O_RDONLY)) != -1) { |
| 197 | | | new_input = t_new(struct input_stack, 1);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/data-stack.h |
| |
75 | #define t_new(type, count) \ |
76 | ((type *) t_malloc0(sizeof(type) * (count))) |
| |
|
| 198 | | | new_input->prev = input; |
| 199 | | | new_input->path = t_strdup(path); |
| 200 | | | input = new_input; |
| 201 | | | goto newfile; |
| 202 | | | } else { |
| 203 | | | |
| 204 | | | if (strcmp(key, "!include") == 0) { |
| 205 | | | errormsg = t_strdup_printf( |
| 206 | | | "Couldn't open include file %s: %m", line); |
| 207 | | | } |
| 208 | | | } |
| 209 | | | } else if (*line == '=') { |
| 210 | | | |
| 211 | | | *line++ = '\0'; |
| 212 | | | while (IS_WHITE(*line)) line++; |
| 213 | | | |
| 214 | | | len = strlen(line); |
| 215 | | | if (len > 0 && |
| 216 | | | ((*line == '"' && line[len-1] == '"') || |
| 217 | | | (*line == '\'' && line[len-1] == '\''))) { |
| 218 | | | line[len-1] = '\0'; |
| 219 | | | line = str_unescape(line+1); |
| 220 | | | } |
| 221 | | | |
| 222 | | | errormsg = skip ? NULL : |
| 223 | | | callback(key, line, context); |
| 224 | | | } else if (strcmp(key, "}") != 0 || *line != '\0') { |
| 225 | | | |
| 226 | | | line[-1] = '\0'; |
| 227 | | | |
| 228 | | | if (*line == '{') |
| 229 | | | name = ""; |
| 230 | | | else { |
| 231 | | | name = line; |
| 232 | | | while (!IS_WHITE(*line) && *line != '\0') |
| 233 | | | line++; |
| 234 | | | |
| 235 | | | if (*line != '\0') { |
| 236 | | | *line++ = '\0'; |
| 237 | | | while (IS_WHITE(*line)) |
| 238 | | | line++; |
| 239 | | | } |
| 240 | | | } |
| 241 | | | |
| 242 | | | if (*line != '{') |
| 243 | | | errormsg = "Expecting '='"; |
| 244 | | | else { |
| 245 | | | sections++; |
| 246 | | | if (next_section != NULL && |
| 247 | | | strcmp(next_section, name) == 0) { |
| 248 | | | section += strlen(next_section); |
| 249 | | | if (*section == '\0') { |
| 250 | | | skip = 0; |
| 251 | | | next_section = NULL; |
| 252 | | | root_section = sections; |
| 253 | | | } else { |
| 254 | | | i_assert(*section == '/');
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 255 | | | section++; |
| 256 | | | next_section = |
| 257 | | | t_strcut(section, '/'); |
| 258 | | | } |
| 259 | | | } |
| 260 | | | |
| 261 | | | if (skip > 0) |
| 262 | | | skip++; |
| 263 | | | else { |
| 264 | | | skip = sect_callback == NULL ? 1 : |
| 265 | | | !sect_callback(key, name, |
| 266 | | | context, |
| 267 | | | &errormsg); |
| 268 | | | if (errormsg != NULL && |
| 269 | | | last_section_line != 0) { |
| 270 | | | errormsg = t_strdup_printf( |
| 271 | | | SECTION_ERRORMSG, |
| 272 | | | errormsg, |
| 273 | | | last_section_path, |
| 274 | | | last_section_line); |
| 275 | | | } |
| 276 | | | } |
| 277 | | | last_section_path = input->path; |
| 278 | | | last_section_line = input->linenum; |
| 279 | | | } |
| 280 | | | } else { |
| 281 | | | |
| 282 | | | if (sections == 0) |
| 283 | | | errormsg = "Unexpected '}'"; |
| 284 | | | else { |
| 285 | | | if (skip > 0) |
| 286 | | | skip--; |
| 287 | | | else { |
| 288 | | | sect_callback(NULL, NULL, context, |
| 289 | | | &errormsg); |
| 290 | | | if (root_section == sections && |
| 291 | | | errormsg == NULL) { |
| 292 | | | |
| 293 | | | |
| 294 | | | break; |
| 295 | | | } |
| 296 | | | } |
| 297 | | | last_section_path = input->path; |
| 298 | | | last_section_line = input->linenum; |
| 299 | | | sections--; |
| 300 | | | } |
| 301 | | | } |
| 302 | | | |
| 303 | | | if (errormsg != NULL) { |
| 304 | | | i_error("Error in configuration file %s line %d: %s", |
| 305 | | | input->path, input->linenum, errormsg); |
| 306 | | | break; |
| 307 | | | } |
| 308 | | | str_truncate(full_line, 0); |
| 309 | | | } |
| 310 | | | |
| 311 | | | i_stream_destroy(&input->input); |
| 312 | | | input = input->prev; |
| 313 | | | if (line == NULL && input != NULL) |
| 314 | | | goto prevfile; |
| 315 | | | |
| 316 | | | return errormsg == NULL; |
| 317 | | | } |
| |