(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/lazy-expunge/lazy-expunge-plugin.c) |
| |
| 516 | | | static void lazy_expunge_mail_storage_init(struct mail_storage *storage) |
| 517 | | | { |
| 518 | | | struct lazy_expunge_mailbox_list *llist = |
| 519 | | | LAZY_EXPUNGE_LIST_CONTEXT(storage->list);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/lazy-expunge/lazy-expunge-plugin.c |
| |
21 | #define LAZY_EXPUNGE_LIST_CONTEXT(obj) \ |
22 | MODULE_CONTEXT(obj, lazy_expunge_mailbox_list_module) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/module-context.h |
| |
46 | #define MODULE_CONTEXT(obj, id_ctx) \ |
47 | (*((void **)array_idx_modifiable(&(obj)->module_contexts, \ |
48 | (id_ctx).id.module_id) + \ |
49 | OBJ_REGISTER_COMPATIBLE(obj, id_ctx))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
179 | #define array_idx_modifiable(array, idx) \ |
180 | ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
181 | array_idx_modifiable_i(&(array)->arr, idx) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
45 | # define ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
46 | (typeof(*(array)->v_modifiable)) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/module-context.h |
| |
43 | #define OBJ_REGISTER_COMPATIBLE(obj, id_ctx) \ |
44 | COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(OBJ_REGISTER(obj), (id_ctx).reg) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
158 | # define COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(_a, _b) \ |
159 | COMPILE_ERROR_IF_TRUE( \ |
160 | !__builtin_types_compatible_p(typeof(_a), typeof(_b))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
156 | # define COMPILE_ERROR_IF_TRUE(condition) \ |
157 | (sizeof(char[1 - 2 * !!(condition)]) - 1) |
| |
|
| 520 | | | struct lazy_expunge_mail_storage *lstorage; |
| 521 | | | const char *const *p; |
| 522 | | | unsigned int i; |
| 523 | | | |
| 524 | | | |
| 525 | | | |
| 526 | [+] | | p = t_strsplit_spaces(getenv("LAZY_EXPUNGE"), " "); |
Event 1:
getenv() returns NULL. - Dereferenced later, causing the null pointer dereference.
hide
Event 2:
getenv("LAZY_EXPUNGE"), which evaluates to NULL, is passed to t_strsplit_spaces() as the first argument. See related event 1.
hide
|
|
 |
| |