(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/mbox/istream-raw-mbox.c) |
| |
| 50 | | | static int mbox_read_from_line(struct raw_mbox_istream *rstream) |
| 51 | | | { |
| 52 | | | const unsigned char *buf, *p; |
| 53 | | | char *sender; |
| 54 | | | time_t received_time; |
| 55 | | | size_t pos, line_pos; |
| 56 | | | ssize_t ret; |
| 57 | | | unsigned int skip; |
| 58 | | | int tz; |
| 59 | | | |
| 60 | | | buf = i_stream_get_data(rstream->istream.parent, &pos); |
| 61 | | | i_assert(pos > 0);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 1:
Skipping " if". pos > 0 evaluates to true.
hide
Event 2:
Skipping " if". !(pos > 0) evaluates to false.
hide
Event 3:
Skipping " if". !!(pos > 0) evaluates to true.
hide
Event 4:
Skipping " if". !!!(pos > 0) evaluates to false.
hide
Event 5:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 62 | | | |
| 63 | | | |
| 64 | | | |
| 65 | | | if (rstream->from_offset == 0) |
Event 6:
Taking true branch. rstream->from_offset == 0 evaluates to true.
hide
|
|
| 66 | | | skip = 0; |
Event 7:
skip is set to 0.
hide
|
|
| 67 | | | else { |
| 68 | | | skip = 1; |
| 69 | | | if (*buf == '\r') |
| 70 | | | skip++; |
| 71 | | | } |
| 72 | | | |
| 73 | | | while ((p = memchr(buf+skip, '\n', pos-skip)) == NULL) { |
Event 8:
Entering loop body. (p = memchr(...)) == (void *)0 evaluates to true.
hide
|
|
| 74 | | | ret = i_stream_read(rstream->istream.parent); |
| 75 | [+] | | buf = i_stream_get_data(rstream->istream.parent, &pos); |
 |
| 76 | | | if (ret < 0) { |
Event 12:
Taking true branch. ret < 0 evaluates to true.
hide
|
|
| 77 | | | if (ret == -2) { |
Event 13:
Taking true branch. ret == -2 evaluates to true.
hide
|
|
| 78 | | | |
| 79 | | | |
| 80 | | | break; |
| 81 | | | } |
| 82 | | | |
| 83 | | | rstream->istream.istream.eof = |
| 84 | | | rstream->istream.parent->eof; |
| 85 | | | rstream->istream.istream.stream_errno = |
| 86 | | | rstream->istream.parent->stream_errno; |
| 87 | | | return -1; |
| 88 | | | } |
| 89 | | | i_assert(pos > 0);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 90 | | | } |
| 91 | | | line_pos = p == NULL ? 0 : (size_t)(p - buf); |
Event 14:
p == (void *)0 evaluates to true.
hide
|
|
| 92 | | | |
| 93 | | | |
| 94 | | | if (memcmp(buf+skip, "From ", 5) != 0 || |
Event 15:
NULL is passed to memcmp() as the first argument. - Dereferenced later, causing the null pointer dereference.
See related events 7 and 11.
hide
Null Pointer Dereference
The body of memcmp() dereferences buf + skip, but it is NULL. The issue can occur if the highlighted code executes. See related event 15. Show: All events | Only primary events |
|
| |