(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/maildir/maildir-storage.c) |
| |
| 421 | | | static struct mailbox * |
| 422 | | | maildir_open(struct maildir_storage *storage, const char *name, |
| 423 | | | enum mailbox_open_flags flags) |
| 424 | | | { |
| 425 | | | struct maildir_mailbox *mbox; |
| 426 | | | struct mail_index *index; |
| 427 | | | const char *path, *shared_path, *control_dir; |
| 428 | | | struct stat st; |
| 429 | | | pool_t pool; |
| 430 | | | |
| 431 | | | path = mailbox_list_get_path(storage->storage.list, name, |
| 432 | | | MAILBOX_LIST_PATH_TYPE_MAILBOX); |
| 433 | | | control_dir = mailbox_list_get_path(storage->storage.list, name, |
| 434 | | | MAILBOX_LIST_PATH_TYPE_CONTROL); |
| 435 | | | |
| 436 | | | pool = pool_alloconly_create("maildir mailbox", 1024+512); |
| 437 | | | mbox = p_new(pool, struct maildir_mailbox, 1);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/mempool.h |
| |
84 | #define p_new(pool, type, count) \ |
85 | ((type *) p_malloc(pool, sizeof(type) * (count))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/mempool.h |
| |
87 | #define p_malloc(pool, size) (pool)->v->malloc(pool, size) |
| |
|
| 438 | | | mbox->ibox.box = maildir_mailbox; |
| 439 | | | mbox->ibox.box.pool = pool; |
| 440 | | | mbox->ibox.storage = &storage->storage; |
| 441 | | | mbox->ibox.mail_vfuncs = &maildir_mail_vfuncs; |
| 442 | | | |
| 443 | | | mbox->storage = storage; |
| 444 | | | mbox->path = p_strdup(pool, path); |
| 445 | | | |
| 446 | | | index = index_storage_alloc(&storage->storage, name, flags, |
| 447 | | | MAILDIR_INDEX_PREFIX); |
| 448 | | | mbox->ibox.index = index; |
| 449 | | | mbox->very_dirty_syncs = getenv("MAILDIR_VERY_DIRTY_SYNCS") != NULL; |
Event 1:
getenv(...) != (void *)0 evaluates to false.
hide
|
|
| 450 | | | |
| 451 | | | |
| 452 | | | |
| 453 | [+] | | shared_path = t_strconcat(path, "/dovecot-shared", NULL); |
 |
| 454 | | | if (stat(shared_path, &st) == 0) { |
Event 8:
shared_path, which evaluates to NULL, is passed to stat64() as the first argument. See related event 7.
hide
Null Pointer Dereference
The body of stat64() dereferences shared_path, but it is NULL. The issue can occur if the highlighted code executes. See related event 8. Show: All events | Only primary events |
|
| |