(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/mbox/mbox-save.c) |
| |
| 653 | | | int mbox_save_finish(struct mail_save_context *_ctx) |
| 654 | | | { |
| 655 | | | struct mbox_save_context *ctx = (struct mbox_save_context *)_ctx; |
Event 1:
ctx is set to _ctx. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 656 | | | |
| 657 | | | if (!ctx->failed && ctx->eoh_offset == (uoff_t)-1) |
Event 2:
Skipping " if". ctx->failed evaluates to true.
hide
|
|
| 658 | | | (void)(ctx); |
| 659 | | | |
| 660 | | | if (ctx->output != NULL) { |
Event 3:
Skipping " if". ctx->output != (void *)0 evaluates to false.
hide
Event 4:
Considering the case where ctx->output is equal to 0 so _ctx[2].guid must have been equal to 0. See related event 1.
hide
|
|
| 661 | | | |
| 662 | | | if (o_stream_flush(ctx->output) < 0) |
| 663 | | | write_error(ctx); |
| 664 | | | } |
| 665 | | | |
| 666 | | | ctx->finished = TRUE; |
Event 5:
!0 evaluates to true.
hide
|
|
| 667 | | | if (!ctx->failed) { |
Event 6:
Skipping " if". ctx->failed evaluates to true.
hide
|
|
| 668 | | | T_BEGIN {
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/data-stack.h |
| |
49 | #define T_BEGIN \ |
50 | STMT_START { unsigned int _data_stack_cur_id = t_push(); |
| |
|
| 669 | | | if (mbox_write_content_length(ctx) < 0 || |
| 670 | | | mbox_append_lf(ctx) < 0) |
| 671 | | | ctx->failed = TRUE; |
| 672 | | | } T_END; |
| 673 | | | } |
| 674 | | | |
| 675 | | | if (ctx->mail != NULL) { |
Event 7:
Skipping " if". ctx->mail != (void *)0 evaluates to false.
hide
|
|
| 676 | | | index_mail_cache_parse_deinit(ctx->mail, ctx->ctx.received_date, |
| 677 | | | !ctx->failed); |
| 678 | | | } |
| 679 | | | if (ctx->input != NULL) |
Event 8:
Skipping " if". ctx->input != (void *)0 evaluates to false.
hide
|
|
| 680 | | | i_stream_destroy(&ctx->input); |
| 681 | | | |
| 682 | | | if (ctx->failed && ctx->mail_offset != (uoff_t)-1) { |
| 683 | | | |
| 684 | [+] | | (void)o_stream_flush(ctx->output); |
Event 10:
ctx->output, which evaluates to _ctx[2].guid, is passed to o_stream_flush(). See related event 1.
hide
|
|
 |
| |