(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/virtual/virtual-sync.c) |
| |
| 133 | | | static bool (struct virtual_sync_context *ctx) |
| 134 | | | { |
| 135 | | | const struct *ext_hdr; |
| 136 | | | const struct *hdr; |
| 137 | | | const struct virtual_mail_index_mailbox_record *mailboxes; |
| 138 | | | struct virtual_backend_box *bbox, **bboxes; |
| 139 | | | const void *ext_data; |
| 140 | | | size_t ext_size; |
| 141 | | | unsigned int i, count, ext_name_offset, ext_mailbox_count; |
| 142 | | | uint32_t prev_mailbox_id; |
| 143 | | | bool ret = TRUE; |
Event 1:
!0 evaluates to true.
hide
|
|
| 144 | | | |
| 145 | | | hdr = (ctx->sync_view); |
| 146 | | | (ctx->sync_view, ctx->mbox->virtual_ext_id, |
| 147 | [+] | | &ext_data, &ext_size); |
 |
| 148 | | | ext_hdr = ext_data; |
| 149 | | | if (ctx->mbox->sync_initialized && |
Event 2:
Skipping " if". ctx->mbox->sync_initialized evaluates to false.
hide
|
|
| 150 | | | ctx->mbox->prev_uid_validity == hdr->uid_validity && |
| 151 | | | ext_size >= sizeof(*ext_hdr) && |
| 152 | | | ctx->mbox->prev_change_counter == ext_hdr->change_counter) { |
| 153 | | | |
| 154 | | | return TRUE; |
| 155 | | | } |
| 156 | | | |
| 157 | | | ctx->mbox->sync_initialized = TRUE; |
Event 3:
!0 evaluates to true.
hide
|
|
| 158 | | | ctx->mbox->prev_uid_validity = hdr->uid_validity; |
| 159 | | | if (ext_hdr == NULL || |
| 160 | | | ctx->mbox->search_args_crc32 != ext_hdr->search_args_crc32) { |
| 161 | | | mailboxes = NULL; |
| 162 | | | ext_name_offset = 0; |
| 163 | | | ext_mailbox_count = 0; |
| 164 | | | } else { |
| 165 | | | ctx->mbox->prev_change_counter = ext_hdr->change_counter; |
| 166 | | | mailboxes = (const void *)(ext_hdr + 1); |
| 167 | | | ext_name_offset = sizeof(*ext_hdr) + |
| 168 | | | ext_hdr->mailbox_count * sizeof(*mailboxes); |
| 169 | | | if (ext_name_offset >= ext_size || |
| 170 | | | ext_hdr->mailbox_count > INT_MAX/sizeof(*mailboxes)) { |
| 171 | | | i_error("virtual index %s: Broken mailbox_count ", |
| 172 | | | ctx->mbox->path); |
| 173 | | | ctx->index_broken = TRUE; |
| 174 | | | ext_mailbox_count = 0; |
| 175 | | | ret = FALSE; |
| 176 | | | } else { |
| 177 | | | ext_mailbox_count = ext_hdr->mailbox_count; |
| 178 | | | } |
| 179 | | | } |
| 180 | | | |
| 181 | | | |
| 182 | | | prev_mailbox_id = 0; |
| 183 | | | for (i = 0; i < ext_mailbox_count; i++) { |
Event 6:
Entering loop body. i < ext_mailbox_count evaluates to true.
hide
|
|
| 184 | | | if (mailboxes[i].id > ext_hdr->highest_mailbox_id || |
Event 7:
Skipping " if". - mailboxes[i].id > ext_hdr->highest_mailbox_id evaluates to false.
- mailboxes[i].id <= prev_mailbox_id evaluates to false.
hide
|
|
| 185 | | | mailboxes[i].id <= prev_mailbox_id) { |
| 186 | | | i_error("virtual index %s: Broken mailbox id", |
| 187 | | | ctx->mbox->path); |
| 188 | | | break; |
| 189 | | | } |
| 190 | | | if (mailboxes[i].name_len == 0 || |
Event 8:
Skipping " if". - mailboxes[i].name_len == 0 evaluates to false.
- mailboxes[i].name_len > ext_size evaluates to false.
hide
|
|
| 191 | | | mailboxes[i].name_len > ext_size) { |
| 192 | | | i_error("virtual index %s: Broken mailbox name_len", |
| 193 | | | ctx->mbox->path); |
| 194 | | | break; |
| 195 | | | } |
| 196 | | | if (ext_name_offset + mailboxes[i].name_len > ext_size) { |
Event 9:
Skipping " if". ext_name_offset + mailboxes[i].name_len > ext_size evaluates to false.
hide
|
|
| 197 | | | i_error("virtual index %s: Broken mailbox list", |
| 198 | | | ctx->mbox->path); |
| 199 | | | break; |
| 200 | | | } |
| 201 | | | T_BEGIN {
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/data-stack.h |
| |
49 | #define T_BEGIN \ |
50 | STMT_START { unsigned int _data_stack_cur_id = t_push(); |
| |
|
| 202 | | | const unsigned char *nameptr; |
| 203 | | | const char *name; |
| 204 | | | |
| 205 | | | nameptr = CONST_PTR_OFFSET(ext_data, ext_name_offset);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
| 206 | [+] | | name = t_strndup(nameptr, mailboxes[i].name_len); |
 |
| 207 | [+] | | bbox = virtual_backend_box_lookup_name(ctx->mbox, name); |
Event 19:
name, which evaluates to NULL, is passed to virtual_backend_box_lookup_name() as the second argument. See related event 18.
hide
|
|
 |
| |