(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/mbox/mbox-save.c) |
| |
| 569 | | | int mbox_save_continue(struct mail_save_context *_ctx) |
| 570 | | | { |
| 571 | | | struct mbox_save_context *ctx = (struct mbox_save_context *)_ctx; |
| 572 | | | const unsigned char *data; |
| 573 | | | size_t i, size; |
| 574 | | | ssize_t ret; |
| 575 | | | |
| 576 | | | if (ctx->failed) |
Event 1:
Skipping " if". ctx->failed evaluates to false.
hide
|
|
| 577 | | | return -1; |
| 578 | | | |
| 579 | | | if (ctx->eoh_offset != (uoff_t)-1) { |
Event 2:
Skipping " if". ctx->eoh_offset != (uoff_t)-1 evaluates to false.
hide
|
|
| 580 | | | |
| 581 | | | return mbox_save_body(ctx); |
| 582 | | | } |
| 583 | | | |
| 584 | [+] | | while ((ret = i_stream_read(ctx->input)) > 0) { |
 |
| 585 | | | if (ctx->mail != NULL) |
Event 19:
Skipping " if". ctx->mail != (void *)0 evaluates to false.
hide
|
|
| 586 | | | index_mail_cache_parse_continue(ctx->mail); |
| 587 | | | |
| 588 | [+] | | data = i_stream_get_data(ctx->input, &size); |
 |
| 589 | | | for (i = 0; i < size; i++) { |
Event 23:
Leaving loop. i < size evaluates to false.
hide
|
|
| 590 | | | if (data[i] == '\n' && |
| 591 | | | ((i == 0 && ctx->last_char == '\n') || |
| 592 | | | (i > 0 && data[i-1] == '\n'))) { |
| 593 | | | |
| 594 | | | |
| 595 | | | break; |
| 596 | | | } |
| 597 | | | } |
| 598 | | | if (i != size) { |
Event 24:
Skipping " if". i != size evaluates to false.
hide
|
|
| 599 | | | |
| 600 | | | |
| 601 | | | if (o_stream_send(ctx->output, data, i) < 0) |
| 602 | | | return write_error(ctx); |
| 603 | | | ctx->last_char = '\n'; |
| 604 | | | i_stream_skip(ctx->input, i + 1); |
| 605 | | | break; |
| 606 | | | } |
| 607 | | | |
| 608 | | | if (o_stream_send(ctx->output, data, size) < 0) |
Event 25:
Skipping " if". o_stream_send(...) < 0 evaluates to false.
hide
|
|
| 609 | | | return write_error(ctx); |
| 610 | | | ctx->last_char = data[size-1]; |
Null Pointer Dereference
data is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 22. Show: All events | Only primary events |
|
| 611 | | | i_stream_skip(ctx->input, size); |
| |