(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/fts-squat/squat-uidlist.c) |
| |
| 313 | | | static int squat_uidlist_map_blocks(struct squat_uidlist *uidlist) |
| 314 | | | { |
| 315 | | | const struct *hdr = &uidlist->hdr; |
| 316 | | | const void *base; |
| 317 | | | uint32_t block_count, blocks_offset, blocks_size, i, verify_count; |
| 318 | | | |
| 319 | | | if (hdr->block_list_offset == 0) { |
Event 1:
Skipping " if". hdr->block_list_offset == 0 evaluates to false.
hide
|
|
| 320 | | | |
| 321 | | | uidlist->cur_block_count = 0; |
| 322 | | | return 1; |
| 323 | | | } |
| 324 | | | |
| 325 | | | |
| 326 | | | if (uidlist_file_cache_read(uidlist, hdr->block_list_offset, |
| 327 | [+] | | sizeof(block_count)) < 0) |
 |
| 328 | | | return -1; |
| 329 | | | blocks_offset = hdr->block_list_offset + sizeof(block_count); |
| 330 | | | if (blocks_offset > uidlist->data_size) { |
Event 4:
Skipping " if". blocks_offset > uidlist->data_size evaluates to false.
hide
|
|
| 331 | | | squat_uidlist_set_corrupted(uidlist, "block list outside file"); |
| 332 | | | return 0; |
| 333 | | | } |
| 334 | | | |
| 335 | | | base = CONST_PTR_OFFSET(uidlist->data, hdr->block_list_offset);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
| 336 | | | memcpy(&block_count, base, sizeof(block_count)); |
| 337 | | | |
| 338 | | | |
| 339 | | | blocks_size = block_count * sizeof(uint32_t)*2; |
| 340 | [+] | | if (uidlist_file_cache_read(uidlist, blocks_offset, blocks_size) < 0) |
 |
| 341 | | | return -1; |
| 342 | | | if (blocks_offset + blocks_size > uidlist->data_size) { |
Event 7:
Skipping " if". blocks_offset + blocks_size > uidlist->data_size evaluates to false.
hide
|
|
| 343 | | | squat_uidlist_set_corrupted(uidlist, "block list outside file"); |
| 344 | | | return 0; |
| 345 | | | } |
| 346 | | | |
| 347 | | | uidlist->cur_block_count = block_count; |
| 348 | [+] | | squat_uidlist_map_blocks_set_pointers(uidlist); |
Event 8:
uidlist is passed to squat_uidlist_map_blocks_set_pointers().
hide
|
|
 |
| 349 | | | |
| 350 | | | |
| 351 | | | |
| 352 | | | verify_count = I_MIN(block_count, 8); |
Event 12:
block_count < 8 evaluates to true.
hide
|
|
| 353 | | | for (i = 1; i < verify_count; i++) { |
Event 13:
Entering loop body. i < verify_count evaluates to true.
hide
|
|
| 354 | | | if (unlikely(uidlist->cur_block_end_indexes[i-1] >= |
| 355 | | | uidlist->cur_block_end_indexes[i])) { |
Null Pointer Dereference
uidlist->cur_block_end_indexes is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 11. Show: All events | Only primary events |
|
| |