(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-index/mail-index-sync.c) |
| |
| 579 | | | bool mail_index_sync_next(struct mail_index_sync_ctx *ctx, |
| 580 | | | struct mail_index_sync_rec *sync_rec) |
| 581 | | | { |
| 582 | | | struct mail_index_transaction *sync_trans = ctx->sync_trans; |
| 583 | | | struct mail_index_sync_list *sync_list; |
| 584 | | | const struct uid_range *uid_range = NULL; |
Event 1:
uid_range is set to NULL. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 585 | | | unsigned int i, count, next_i; |
| 586 | | | uint32_t next_found_uid; |
| 587 | | | |
| 588 | | | next_i = (unsigned int)-1; |
| 589 | | | next_found_uid = (uint32_t)-1; |
| 590 | | | |
| 591 | | | |
| 592 | | | |
| 593 | | | |
| 594 | [+] | | sync_list = array_get_modifiable(&ctx->sync_list, &count);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
174 | #define array_get_modifiable(array, count) \ |
175 | ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
176 | array_get_modifiable_i(&(array)->arr, count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
45 | # define ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
46 | (typeof(*(array)->v_modifiable)) |
| |
|
 |
| 595 | | | for (i = 0; i < count; i++) { |
Event 2:
Leaving loop. i < count evaluates to false.
hide
|
|
| 596 | | | if (!array_is_created(sync_list[i].array) ||
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
91 | #define array_is_created(array) \ |
92 | array_is_created_i(&(array)->arr) |
| |
|
| 597 | | | sync_list[i].idx == array_count(sync_list[i].array)) |
| 598 | | | continue; |
| 599 | | | |
| 600 | | | uid_range = array_idx(sync_list[i].array, sync_list[i].idx);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
165 | #define array_idx(array, idx) \ |
166 | ARRAY_TYPE_CAST_CONST(array)array_idx_i(&(array)->arr, idx) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
43 | # define ARRAY_TYPE_CAST_CONST(array) \ |
44 | (typeof(*(array)->v)) |
| |
|
| 601 | | | if (uid_range->uid1 == ctx->next_uid) { |
| 602 | | | |
| 603 | | | break; |
| 604 | | | } |
| 605 | | | if (uid_range->uid1 < next_found_uid) { |
| 606 | | | next_i = i; |
| 607 | | | next_found_uid = uid_range->uid1; |
| 608 | | | } |
| 609 | | | } |
| 610 | | | |
| 611 | | | if (i == count) { |
Event 3:
Skipping " if". i == count evaluates to false.
hide
|
|
| 612 | | | if (next_i == (unsigned int)-1) { |
| 613 | | | |
| 614 | | | if (ctx->sync_appends) { |
| 615 | | | ctx->sync_appends = FALSE; |
| 616 | | | sync_rec->type = MAIL_INDEX_SYNC_TYPE_APPEND; |
| 617 | | | sync_rec->uid1 = ctx->append_uid_first; |
| 618 | | | sync_rec->uid2 = ctx->append_uid_last; |
| 619 | | | return TRUE; |
| 620 | | | } |
| 621 | | | return FALSE; |
| 622 | | | } |
| 623 | | | ctx->next_uid = next_found_uid; |
| 624 | | | i = next_i; |
| 625 | | | uid_range = array_idx(sync_list[i].array, sync_list[i].idx);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
165 | #define array_idx(array, idx) \ |
166 | ARRAY_TYPE_CAST_CONST(array)array_idx_i(&(array)->arr, idx) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
43 | # define ARRAY_TYPE_CAST_CONST(array) \ |
44 | (typeof(*(array)->v)) |
| |
|
| 626 | | | } |
| 627 | | | |
| 628 | | | if (sync_list[i].array == (void *)&sync_trans->expunges) { |
Event 4:
Taking false branch. sync_list[i].array == (void *)&sync_trans->expunges evaluates to false.
hide
|
|
| 629 | | | mail_index_sync_get_expunge(sync_rec, |
| 630 | | | (const struct mail_transaction_expunge *)uid_range); |
| 631 | | | } else if (sync_list[i].array == (void *)&sync_trans->updates) { |
Event 5:
Taking false branch. sync_list[i].array == (void *)&sync_trans->updates evaluates to false.
hide
|
|
| 632 | | | mail_index_sync_get_update(sync_rec, |
| 633 | | | (const struct mail_transaction_flag_update *)uid_range); |
| 634 | | | } else if (sync_list[i].array == (void *)&sync_trans->keyword_resets) { |
Event 6:
Taking false branch. sync_list[i].array == (void *)&sync_trans->keyword_resets evaluates to false.
hide
|
|
| 635 | | | mail_index_sync_get_keyword_reset(sync_rec, uid_range); |
| 636 | | | } else { |
| 637 | | | mail_index_sync_get_keyword_update(sync_rec, uid_range, |
Event 7:
uid_range, which evaluates to NULL, is passed to mail_index_sync_get_keyword_update() as the second argument. See related event 1.
hide
|
|
| 638 | [+] | | &sync_list[i]); |
 |
| |