(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/virtual/virtual-storage.c) |
| |
| 202 | | | static int virtual_mailboxes_open(struct virtual_mailbox *mbox, |
| 203 | | | enum mailbox_open_flags open_flags) |
| 204 | | | { |
| 205 | | | struct mail_user *user = mbox->storage->storage.ns->user; |
| 206 | | | struct virtual_backend_box *const *bboxes; |
| 207 | | | struct mail_namespace *ns; |
| 208 | | | struct mail_storage *storage; |
| 209 | | | unsigned int i, count; |
| 210 | | | enum mail_error error; |
| 211 | | | const char *str, *mailbox; |
| 212 | | | |
| 213 | | | open_flags |= MAILBOX_OPEN_KEEP_RECENT; |
| 214 | | | |
| 215 | | | bboxes = array_get(&mbox->backend_boxes, &count);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
156 | #define array_get(array, count) \ |
157 | ARRAY_TYPE_CAST_CONST(array)array_get_i(&(array)->arr, count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
43 | # define ARRAY_TYPE_CAST_CONST(array) \ |
44 | (typeof(*(array)->v)) |
| |
|
| 216 | | | for (i = 0; i < count; ) { |
Event 1:
Performing all but the last two loop iterations.
hide
Event 2:
Continuing from loop body. Entering loop body. i < count evaluates to true.
hide
|
|
| 217 | | | mailbox = bboxes[i]->name; |
| 218 | [+] | | ns = mail_namespace_find(user->namespaces, &mailbox); |
 |
| 219 | | | storage = ns->storage; |
Null Pointer Dereference
ns is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 10. Show: All events | Only primary events |
|
| 220 | | | bboxes[i]->box = mailbox_open(&storage, mailbox, |
| 221 | | | NULL, open_flags); |
| 222 | | | |
| 223 | | | if (bboxes[i]->box == NULL) { |
| 224 | | | str = mail_storage_get_last_error(storage, &error); |
| 225 | | | if (bboxes[i]->wildcard && |
| 226 | | | (error == MAIL_ERROR_PERM || |
| 227 | | | error == MAIL_ERROR_NOTFOUND)) { |
| 228 | | | |
| 229 | | | |
| 230 | | | mail_search_args_unref(&bboxes[i]->search_args); |
| 231 | | | array_delete(&mbox->backend_boxes, i, 1);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
147 | #define array_delete(array, idx, count) \ |
148 | array_delete_i(&(array)->arr, idx, count) |
| |
|
| 232 | | | bboxes = array_get(&mbox->backend_boxes, &count);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
156 | #define array_get(array, count) \ |
157 | ARRAY_TYPE_CAST_CONST(array)array_get_i(&(array)->arr, count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
43 | # define ARRAY_TYPE_CAST_CONST(array) \ |
44 | (typeof(*(array)->v)) |
| |
|
| 233 | | | continue; |
| 234 | | | } |
| 235 | | | if (storage != mbox->ibox.box.storage) { |
| 236 | | | |
| 237 | | | mail_storage_set_error(mbox->ibox.box.storage, |
| 238 | | | error, str); |
| 239 | | | } |
| 240 | | | break; |
| 241 | | | } |
| 242 | | | i_array_init(&bboxes[i]->uids, 64);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
37 | #define i_array_init(array, init_count) \ |
38 | p_array_init(array, default_pool, init_count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
35 | #define p_array_init(array, pool, init_count) \ |
36 | array_create(array, pool, sizeof(**(array)->v), init_count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
75 | #define array_create(array, pool, element_size, init_count) \ |
76 | array_create_i(&(array)->arr, pool, element_size, init_count) |
| |
|
| 243 | | | i_array_init(&bboxes[i]->sync_pending_removes, 64);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
37 | #define i_array_init(array, init_count) \ |
38 | p_array_init(array, default_pool, init_count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
35 | #define p_array_init(array, pool, init_count) \ |
36 | array_create(array, pool, sizeof(**(array)->v), init_count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
75 | #define array_create(array, pool, element_size, init_count) \ |
76 | array_create_i(&(array)->arr, pool, element_size, init_count) |
| |
|
| 244 | | | mail_search_args_init(bboxes[i]->search_args, bboxes[i]->box, |
| 245 | | | FALSE, NULL); |
| 246 | | | i++; |
| |