(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/maildir/maildir-save.c) |
| |
| 67 | | | static int maildir_file_move(struct maildir_save_context *ctx, |
| 68 | | | const char *tmpname, const char *destname, |
| 69 | | | bool newdir) |
| 70 | | | { |
| 71 | | | struct mail_storage *storage = &ctx->mbox->storage->storage; |
| 72 | | | const char *tmp_path, *new_path; |
| 73 | | | int ret; |
| 74 | | | |
| 75 | | | |
| 76 | | | |
| 77 | | | |
| 78 | | | |
| 79 | [+] | | tmp_path = t_strconcat(ctx->tmpdir, "/", tmpname, NULL); |
 |
| 80 | | | new_path = newdir ? |
Event 7:
newdir evaluates to true.
hide
|
|
| 81 | | | t_strconcat(ctx->newdir, "/", destname, NULL) : |
| 82 | | | t_strconcat(ctx->curdir, "/", destname, NULL); |
| 83 | | | |
| 84 | | | |
| 85 | | | |
| 86 | | | |
| 87 | | | |
| 88 | | | |
| 89 | | | |
| 90 | | | |
| 91 | | | |
| 92 | | | |
| 93 | | | |
| 94 | | | if (rename(tmp_path, new_path) == 0) |
Event 8:
tmp_path, which evaluates to NULL, is passed to rename() as the first argument. See related event 6.
hide
Null Pointer Dereference
The body of rename() dereferences tmp_path, but it is NULL. The issue can occur if the highlighted code executes. See related event 8. Show: All events | Only primary events |
|
| |