(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/login-common/main.c) |
| |
| 195 | | | void main_listen_stop(void) |
| 196 | | | { |
| 197 | | | struct io **ios; |
| 198 | | | unsigned int i, count; |
| 199 | | | int cur_fd; |
| 200 | | | |
| 201 | | | if (!listening) |
Event 1:
Skipping " if". listening evaluates to true.
hide
|
|
| 202 | | | return; |
| 203 | | | |
| 204 | [+] | | ios = array_get_modifiable(&listen_ios, &count);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
174 | #define array_get_modifiable(array, count) \ |
175 | ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
176 | array_get_modifiable_i(&(array)->arr, count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
45 | # define ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
46 | (typeof(*(array)->v_modifiable)) |
| |
|
 |
| 205 | | | for (i = 0; i < count; i++) |
| 206 | | | io_remove(&ios[i]); |
| 207 | | | array_free(&listen_ios); |
| 208 | | | |
| 209 | | | if (closing_down) { |
Event 3:
Taking true branch. closing_down evaluates to true.
hide
|
|
| 210 | | | cur_fd = LOGIN_MASTER_SOCKET_FD + 1; |
| 211 | | | for (i = 0; i < count; i++, cur_fd++) { |
Event 5:
During loop iterations, cur_fd is set to cur_fd + 1, which evaluates to an unknown [ ?unknown: the analysis lost precision when tracking this value, so this warning may be a false positive] value .
hide
Event 6:
During loop iterations, cur_fd is closed, where cur_fd is the value assigned to cur_fd.
hide
Event 7:
Continuing from loop body. Entering loop body. i < count evaluates to true.
hide
|
|
| 212 | | | if (close(cur_fd) < 0) { |
Event 8:
cur_fd, which evaluates to the value assigned to cur_fd at main.c:211, plus 1, is passed to close(). See related event 5.
hide
Double Close
The memory pointed to by cur_fd was freed at main.c:211 and is freed again here by close(). The issue can occur if the highlighted code executes. See related events 6 and 8. Show: All events | Only primary events |
|
| 213 | | | i_fatal("close(listener %d) failed: %m", |
| 214 | | | cur_fd); |
| |