(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-index/mail-index-transaction-view.c) |
| |
| 72 | | | static const struct mail_index_record * |
| 73 | | | tview_apply_flag_updates(struct mail_index_view_transaction *tview, |
| 74 | | | const struct mail_index_record *rec, uint32_t seq) |
| 75 | | | { |
| 76 | | | struct mail_index_transaction *t = tview->t; |
Event 1:
t is set to tview->t. - Determines the allocation size later.
hide
|
|
| 77 | | | const struct mail_transaction_flag_update *updates; |
| 78 | | | unsigned int idx, count; |
| 79 | | | |
| 80 | | | |
| 81 | | | if (seq < t->min_flagupdate_seq || seq > t->max_flagupdate_seq || |
Event 2:
Skipping " if". - seq < t->min_flagupdate_seq evaluates to false.
- seq > t->max_flagupdate_seq evaluates to false.
hide
|
|
| 82 | [+] | | !array_is_created(&t->updates))
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
91 | #define array_is_created(array) \ |
92 | array_is_created_i(&(array)->arr) |
| |
|
 |
| 83 | | | return rec; |
| 84 | | | |
| 85 | | | updates = array_get(&t->updates, &count);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
156 | #define array_get(array, count) \ |
157 | ARRAY_TYPE_CAST_CONST(array)array_get_i(&(array)->arr, count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
43 | # define ARRAY_TYPE_CAST_CONST(array) \ |
44 | (typeof(*(array)->v)) |
| |
|
| 86 | | | idx = mail_index_transaction_get_flag_update_pos(t, 0, count, seq); |
| 87 | | | if (seq < updates[idx].uid1 || seq > updates[idx].uid2) |
Event 5:
Skipping " if". - seq < updates[idx].uid1 evaluates to false.
- seq > updates[idx].uid2 evaluates to false.
hide
|
|
| 88 | | | return rec; |
| 89 | | | |
| 90 | | | |
| 91 | | | |
| 92 | | | |
| 93 | | | |
| 94 | | | if (tview->recs == NULL) { |
Event 6:
Taking true branch. tview->recs == (void *)0 evaluates to true.
hide
|
|
| 95 | | | tview->recs_count = t->first_new_seq; |
Event 7:
tview->recs_count is set to t->first_new_seq, which evaluates to tview->t->first_new_seq. See related event 1.
hide
|
|
| 96 | | | tview->recs = i_new(struct mail_index_record,
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/imem.h |
| |
8 | #define i_new(type, count) ((type *) i_malloc(sizeof(type) * (count))) |
| |
|
| 97 | [+] | | tview->recs_count); |
Event 8:
8 * tview->recs_count, which evaluates to 8 * tview->t->first_new_seq, is passed to i_malloc(). - This multiplication may overflow and it is used as the allocation size later.
See related event 7.
hide
|
|
 |
| |