(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/maildir/maildir-sync-index.c) |
| |
| 64 | | | static int maildir_sync_flags(struct maildir_mailbox *mbox, const char *path, |
| 65 | | | struct maildir_index_sync_context *ctx) |
| 66 | | | { |
| 67 | | | struct mailbox *box = &mbox->ibox.box; |
| 68 | | | struct stat st; |
| 69 | | | const char *dir, *fname, *newfname, *newpath; |
| 70 | | | enum mail_index_sync_type sync_type; |
| 71 | | | uint8_t flags8; |
| 72 | | | |
| 73 | | | fname = strrchr(path, '/'); |
| 74 | | | i_assert(fname != NULL);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 1:
Skipping " if". fname != (void *)0 evaluates to true.
hide
Event 2:
Skipping " if". !(fname != (void *)0) evaluates to false.
hide
Event 3:
Skipping " if". !!(fname != (void *)0) evaluates to true.
hide
Event 4:
Skipping " if". !!!(fname != (void *)0) evaluates to false.
hide
Event 5:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 75 | | | fname++; |
| 76 | | | dir = t_strdup_until(path, fname); |
| 77 | | | |
| 78 | | | |
| 79 | | | maildir_filename_get_flags(ctx->keywords_sync_ctx, |
| 80 | | | fname, &ctx->flags, &ctx->keywords); |
| 81 | | | |
| 82 | | | |
| 83 | | | flags8 = ctx->flags; |
| 84 | | | index_sync_changes_apply(ctx->sync_changes, NULL, |
| 85 | | | &flags8, &ctx->keywords, &sync_type); |
| 86 | | | ctx->flags = flags8; |
| 87 | | | |
| 88 | | | |
| 89 | | | newfname = maildir_filename_set_flags(ctx->keywords_sync_ctx, fname, |
| 90 | | | ctx->flags, &ctx->keywords); |
| 91 | [+] | | newpath = t_strconcat(dir, newfname, NULL); |
 |
| 92 | | | if (strcmp(path, newpath) == 0) { |
Event 12:
newpath, which evaluates to NULL, is passed to strcmp() as the second argument. See related event 11.
hide
Null Pointer Dereference
The body of strcmp() dereferences newpath, but it is NULL. The issue can occur if the highlighted code executes. See related event 12. Show: All events | Only primary events |
|
| |