(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/maildir/maildir-mail.c) |
| |
| 337 | | | static int maildir_mail_get_virtual_size(struct mail *_mail, uoff_t *size_r) |
| 338 | | | { |
| 339 | | | struct index_mail *mail = (struct index_mail *)_mail; |
Event 1:
mail is set to _mail. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 340 | | | struct index_mail_data *data = &mail->data; |
Event 2:
data is set to &mail->data, which evaluates to &_mail[7].transaction. See related event 1.
hide
|
|
| 341 | | | struct message_size hdr_size, body_size; |
| 342 | | | struct istream *input; |
| 343 | | | uoff_t old_offset; |
| 344 | | | |
| 345 | [+] | | if (index_mail_get_cached_virtual_size(mail, size_r)) { |
 |
| 346 | | | i_assert(mail->data.virtual_size != (uoff_t)-1);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 347 | | | maildir_handle_size_caching(mail, TRUE, TRUE); |
| 348 | | | return 0; |
| 349 | | | } |
| 350 | | | |
| 351 | [+] | | if (maildir_quick_size_lookup(mail, TRUE, &data->virtual_size) < 0) |
Event 7:
Skipping " if". !0 evaluates to true.
hide
|
|
 |
| 352 | | | return -1; |
| 353 | | | if (data->virtual_size != (uoff_t)-1) { |
Event 12:
Skipping " if". data->virtual_size != (uoff_t)-1 evaluates to false.
hide
|
|
| 354 | | | data->dont_cache_fetch_fields |= MAIL_FETCH_VIRTUAL_SIZE; |
| 355 | | | *size_r = data->virtual_size; |
| 356 | | | return 0; |
| 357 | | | } |
| 358 | | | |
| 359 | | | |
| 360 | | | old_offset = data->stream == NULL ? 0 : data->stream->v_offset; |
Event 13:
data->stream == (void *)0 evaluates to true.
hide
Event 14:
Considering the case where data->stream is equal to 0 so _mail[11].lookup_abort must have been equal to 0. See related event 2.
hide
|
|
| 361 | [+] | | if (mail_get_stream(_mail, &hdr_size, &body_size, &input) < 0) |
 |
| 362 | | | return -1; |
| 363 | [+] | | i_stream_seek(data->stream, old_offset); |
Event 17:
data->stream, which evaluates to _mail[11].lookup_abort, is passed to i_stream_seek() as the first argument. See related event 2.
hide
|
|
 |
| |