(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-index/mail-index-write.c) |
| |
| 16 | | | static int mail_index_recreate(struct mail_index *index) |
| 17 | | | { |
| 18 | | | struct mail_index_map *map = index->map; |
| 19 | | | struct ostream *output; |
| 20 | | | unsigned int base_size; |
| 21 | | | const char *path; |
| 22 | | | int ret = 0, fd; |
| 23 | | | |
| 24 | | | i_assert(!MAIL_INDEX_IS_IN_MEMORY(index));
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 1:
Skipping " if". index->dir == (void *)0 evaluates to false.
hide
Event 2:
Skipping " if". !(index->dir == (void *)0) evaluates to true.
hide
Event 3:
Skipping " if". !!(index->dir == (void *)0) evaluates to false.
hide
Event 4:
Skipping " if". !!!(index->dir == (void *)0) evaluates to true.
hide
Event 5:
Skipping " if". !!!!(index->dir == (void *)0) evaluates to false.
hide
Event 6:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 25 | | | i_assert(map->hdr.indexid == index->indexid);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 7:
Skipping " if". map->hdr.indexid == index->indexid evaluates to true.
hide
Event 8:
Skipping " if". !(map->hdr.indexid == index->indexid) evaluates to false.
hide
Event 9:
Skipping " if". !!(map->hdr.indexid == index->indexid) evaluates to true.
hide
Event 10:
Skipping " if". !!!(map->hdr.indexid == index->indexid) evaluates to false.
hide
Event 11:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 26 | | | |
| 27 | [+] | | fd = mail_index_create_tmp_file(index, &path); |
Event 12:
&path is passed to mail_index_create_tmp_file() as the second argument.
hide
|
|
 |
| 28 | | | if (fd == -1) |
Event 28:
Skipping " if". fd == -1 evaluates to false.
hide
|
|
| 29 | | | return -1; |
| 30 | | | |
| 31 | | | output = o_stream_create_fd_file(fd, 0, FALSE); |
| 32 | | | o_stream_cork(output); |
| 33 | | | |
| 34 | | | base_size = I_MIN(map->hdr., sizeof(map->hdr)); |
Event 29:
map->hdr. < sizeof( map->hdr ) evaluates to true.
hide
|
|
| 35 | | | if (o_stream_send(output, &map->hdr, base_size) < 0 || |
Event 30:
Skipping " if". - o_stream_send(...) < 0 evaluates to false.
- o_stream_send(...) < 0 evaluates to false.
- o_stream_send(...) < 0 evaluates to false.
hide
|
|
| 36 | | | o_stream_send(output, CONST_PTR_OFFSET(map->hdr_base, base_size),
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
| 37 | | | map->hdr. - base_size) < 0 || |
| 38 | | | o_stream_send(output, map->rec_map->records, |
| 39 | | | map->rec_map->records_count * |
| 40 | | | map->hdr.record_size) < 0 || |
| 41 | [+] | | o_stream_flush(output) < 0) { |
 |
| 42 | | | mail_index_file_set_syscall_error(index, path, "write()"); |
| 43 | | | ret = -1; |
| 44 | | | } |
| 45 | | | o_stream_destroy(&output); |
| 46 | | | |
| 47 | | | if (ret == 0 && !index->fsync_disable && fdatasync(fd) < 0) { |
Event 39:
Skipping " if". - ret == 0 evaluates to true.
- index->fsync_disable evaluates to true.
hide
|
|
| 48 | | | mail_index_file_set_syscall_error(index, path, "fdatasync()"); |
| 49 | | | ret = -1; |
| 50 | | | } |
| 51 | | | |
| 52 | | | if (close(fd) < 0) { |
Event 40:
Skipping " if". close(fd) < 0 evaluates to false.
hide
|
|
| 53 | | | mail_index_file_set_syscall_error(index, path, "close()"); |
| 54 | | | ret = -1; |
| 55 | | | } |
| 56 | | | |
| 57 | | | if (ret == 0 && rename(path, index->filepath) < 0) { |
Event 41:
Skipping " if". ret == 0 evaluates to true.
hide
Event 42:
path, which evaluates to NULL, is passed to rename() as the first argument. See related event 25.
hide
Null Pointer Dereference
The body of rename() dereferences path, but it is NULL. The issue can occur if the highlighted code executes. See related event 42. Show: All events | Only primary events |
|
| |