(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/index-storage.c) |
| |
| 148 | | | struct mail_index * |
| 149 | | | index_storage_alloc(struct mail_storage *storage, const char *name, |
| 150 | | | enum mailbox_open_flags flags, const char *prefix) |
| 151 | | | { |
| 152 | | | struct index_list **list, *rec; |
| 153 | | | struct mail_index *index; |
| 154 | | | struct stat st, st2; |
| 155 | | | const char *index_dir, *mailbox_path; |
| 156 | | | int destroy_count; |
| 157 | | | |
| 158 | | | mailbox_path = mailbox_list_get_path(storage->list, name, |
| 159 | | | MAILBOX_LIST_PATH_TYPE_MAILBOX); |
| 160 | | | index_dir = get_index_dir(storage, name, flags, &st); |
| 161 | | | |
| 162 | | | if (index_dir == NULL) |
Event 1:
Taking true branch. index_dir == (void *)0 evaluates to true.
hide
|
|
| 163 | | | memset(&st, 0, sizeof(st)); |
| 164 | | | |
| 165 | | | |
| 166 | | | |
| 167 | | | destroy_count = 0; index = NULL; |
| 168 | | | for (list = &indexes; *list != NULL;) { |
Event 2:
list is set to &indexes.
hide
Event 3:
Entering loop body. *list != (void *)0 evaluates to true.
hide
Event 17:
Continuing from loop body. Leaving loop. *list != (void *)0 evaluates to false.
hide
|
|
| 169 | | | rec = *list; |
Event 4:
rec is set to *list, which evaluates to indexes. See related event 2.
hide
|
|
| 170 | | | |
| 171 | | | if (index_dir != NULL) { |
Event 5:
Taking false branch. index_dir != (void *)0 evaluates to false.
hide
|
|
| 172 | | | if (index == NULL && st.st_ino == rec->index_dir_ino && |
| 173 | | | CMP_DEV_T(st.st_dev, rec->index_dir_dev)) {
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/compat.h |
| |
59 | # define CMP_DEV_T(a, b) (major(a) == major(b) && minor(a) == minor(b)) |
| |
x /usr/include/sys/sysmacros.h |
| |
65 | # define major(dev) gnu_dev_major (dev) |
| |
x /usr/include/sys/sysmacros.h |
| |
65 | # define major(dev) gnu_dev_major (dev) |
| |
x /usr/include/sys/sysmacros.h |
| |
66 | # define minor(dev) gnu_dev_minor (dev) |
| |
x /usr/include/sys/sysmacros.h |
| |
66 | # define minor(dev) gnu_dev_minor (dev) |
| |
|
| 174 | | | |
| 175 | | | |
| 176 | | | |
| 177 | | | if (stat(rec->index->dir, &st2) < 0 || |
| 178 | | | st2.st_ino != st.st_ino || |
| 179 | | | !CMP_DEV_T(st2.st_dev, st.st_dev))
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/compat.h |
| |
59 | # define CMP_DEV_T(a, b) (major(a) == major(b) && minor(a) == minor(b)) |
| |
x /usr/include/sys/sysmacros.h |
| |
65 | # define major(dev) gnu_dev_major (dev) |
| |
x /usr/include/sys/sysmacros.h |
| |
65 | # define major(dev) gnu_dev_major (dev) |
| |
x /usr/include/sys/sysmacros.h |
| |
66 | # define minor(dev) gnu_dev_minor (dev) |
| |
x /usr/include/sys/sysmacros.h |
| |
66 | # define minor(dev) gnu_dev_minor (dev) |
| |
|
| 180 | | | rec->destroy_time = 0; |
| 181 | | | else { |
| 182 | | | rec->refcount++; |
| 183 | | | index = rec->index; |
| 184 | | | } |
| 185 | | | } |
| 186 | | | } else { |
| 187 | | | if (index == NULL && st.st_ino == 0 && |
| 188 | | | strcmp(mailbox_path, rec->mailbox_path) == 0) { |
| 189 | | | rec->refcount++; |
| 190 | | | index = rec->index; |
Event 7:
index is set to rec->index, which evaluates to indexes->index. See related event 4.
hide
|
|
| 191 | | | } |
| 192 | | | } |
| 193 | | | |
| 194 | | | if (rec->refcount == 0) { |
Event 8:
Taking true branch. rec->refcount == 0 evaluates to true.
hide
|
|
| 195 | | | if (rec->destroy_time <= ioloop_time || |
Event 9:
Taking true branch. rec->destroy_time <= ioloop_time evaluates to true.
hide
|
|
| 196 | | | destroy_count >= INDEX_CACHE_MAX) { |
| 197 | | | *list = rec->next; |
| 198 | [+] | | index_list_free(rec); |
Event 10:
rec, which evaluates to indexes, is passed to index_list_free(). See related event 4.
hide
|
|
 |
| 199 | | | continue; |
| 200 | | | } else { |
| 201 | | | destroy_count++; |
| 202 | | | } |
| 203 | | | } |
| 204 | | | |
| 205 | | | list = &(*list)->next; |
| 206 | | | } |
| 207 | | | |
| 208 | | | if (index == NULL) { |
Event 18:
Skipping " if". index == (void *)0 evaluates to false.
hide
|
|
| 209 | | | index = mail_index_alloc(index_dir, prefix); |
| 210 | | | index_storage_add(index, mailbox_path, &st); |
| 211 | | | } |
| 212 | | | |
| 213 | | | return index; |
Event 19:
index_storage_alloc() returns index, which evaluates to indexes->index. See related event 7.
hide
Return Pointer to Freed
index is returned by index_storage_alloc(), but the memory it pointed to has already been freed at mail-index.c:80. - index evaluates to indexes->index. See related event 7.
The issue can occur if the highlighted code executes. See related events 16 and 19. Show: All events | Only primary events |
|
| |