(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/fts-squat/squat-trie.c) |
| |
| 430 | | | node_read_children(struct squat_trie *trie, struct squat_node *node, int level) |
| 431 | | | { |
| 432 | | | const uint8_t *data, *end; |
| 433 | | | const unsigned char *child_chars; |
| 434 | | | struct squat_node *child, *children = NULL; |
| 435 | | | uoff_t node_offset; |
| 436 | | | unsigned int i, child_idx, child_count; |
| 437 | | | uoff_t base_offset; |
| 438 | | | uint32_t num; |
| 439 | | | |
| 440 | | | i_assert(node->children_not_mapped);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 1:
Skipping " if". !node->children_not_mapped evaluates to false.
hide
Event 2:
Skipping " if". !!node->children_not_mapped evaluates to true.
hide
Event 3:
Skipping " if". !!!node->children_not_mapped evaluates to false.
hide
Event 4:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 441 | | | i_assert(!node->have_sequential);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 5:
Skipping " if". !node->have_sequential evaluates to true.
hide
Event 6:
Skipping " if". !!node->have_sequential evaluates to false.
hide
Event 7:
Skipping " if". !!!node->have_sequential evaluates to true.
hide
Event 8:
Skipping " if". !!!!node->have_sequential evaluates to false.
hide
Event 9:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 442 | | | i_assert(trie->unmapped_child_count > 0);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 10:
Skipping " if". trie->unmapped_child_count > 0 evaluates to true.
hide
Event 11:
Skipping " if". !(trie->unmapped_child_count > 0) evaluates to false.
hide
Event 12:
Skipping " if". !!(trie->unmapped_child_count > 0) evaluates to true.
hide
Event 13:
Skipping " if". !!!(trie->unmapped_child_count > 0) evaluates to false.
hide
Event 14:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 443 | | | i_assert(trie->data_size <= trie->locked_file_size);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 15:
Skipping " if". trie->data_size <= trie->locked_file_size evaluates to true.
hide
Event 16:
Skipping " if". !(trie->data_size <= trie->locked_file_size) evaluates to false.
hide
Event 17:
Skipping " if". !!(trie->data_size <= trie->locked_file_size) evaluates to true.
hide
Event 18:
Skipping " if". !!!(trie->data_size <= trie->locked_file_size) evaluates to false.
hide
Event 19:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 444 | | | |
| 445 | | | trie->unmapped_child_count--; |
| 446 | | | node_offset = node->children.offset; |
| 447 | | | node->children_not_mapped = FALSE; |
| 448 | | | node->children.data = NULL; |
Event 20:
node->children is set to 0. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 449 | | | |
| 450 | [+] | | if (trie_file_cache_read(trie, node_offset, TRIE_READAHEAD_SIZE) < 0) |
Event 21:
Skipping " if". 4096 > 1 + 256 + 256 * (sizeof( uint32_t ) * 8 + 7) / 7 evaluates to true.
hide
|
|
 |
| 451 | | | return -1; |
| 452 | | | if (unlikely(node_offset >= trie->data_size)) { |
Event 24:
Skipping " if". node_offset >= trie->data_size evaluates to false.
hide
Event 25:
Skipping " if". !(node_offset >= trie->data_size) evaluates to true.
hide
Event 26:
Skipping " if". !!(node_offset >= trie->data_size) evaluates to false.
hide
Event 27:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 453 | | | squat_trie_set_corrupted(trie); |
| 454 | | | return -1; |
| 455 | | | } |
| 456 | | | |
| 457 | | | data = CONST_PTR_OFFSET(trie->data, node_offset);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
| 458 | | | end = CONST_PTR_OFFSET(trie->data, trie->data_size);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
| 459 | | | child_count = *data++; |
| 460 | | | if (unlikely(node_offset + child_count >= trie->data_size)) { |
Event 28:
Skipping " if". node_offset + child_count >= trie->data_size evaluates to false.
hide
Event 29:
Skipping " if". !(node_offset + child_count >= trie->data_size) evaluates to true.
hide
Event 30:
Skipping " if". !!(node_offset + child_count >= trie->data_size) evaluates to false.
hide
Event 31:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 461 | | | squat_trie_set_corrupted(trie); |
| 462 | | | return -1; |
| 463 | | | } |
| 464 | | | |
| 465 | | | if (child_count == 0) |
Event 32:
Skipping " if". child_count == 0 evaluates to false.
hide
|
|
| 466 | | | return 0; |
| 467 | | | |
| 468 | | | child_chars = data; |
| 469 | | | data += child_count; |
| 470 | | | |
| 471 | | | |
| 472 | | | base_offset = node_offset; |
| 473 | | | for (i = 0; i < child_count; i++) { |
Event 33:
Entering loop body. i < child_count evaluates to true.
hide
|
|
| 474 | | | |
| 475 | | | |
| 476 | | | if (node->have_sequential && child_chars[i] < SEQUENTIAL_COUNT) |
Event 34:
Taking false branch. node->have_sequential evaluates to false.
hide
|
|
| 477 | | | child_idx = child_chars[i]; |
| 478 | | | else { |
| 479 | | | child_idx = node_add_child(trie, node, child_chars[i], |
Event 35:
node is passed to node_add_child() as the second argument.
hide
|
|
| 480 | [+] | | level); |
 |
| |