(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/tests/test-lib.c) |
| |
| 490 | | | static void test_priorityq(void) |
| 491 | | | { |
| 492 | | | #define PQ_MAX_ITEMS 100 |
| 493 | | | static const int input[] = { |
| 494 | | | 1, 2, 3, 4, 5, 6, 7, 8, -1, |
| 495 | | | 8, 7, 6, 5, 4, 3, 2, 1, -1, |
| 496 | | | 8, 7, 5, 6, 1, 3, 4, 2, -1, |
| 497 | | | -1 |
| 498 | | | }; |
| 499 | | | static const int output[] = { |
| 500 | | | 1, 2, 3, 4, 5, 6, 7, 8 |
| 501 | | | }; |
| 502 | | | struct pq_test_item *item, items[PQ_MAX_ITEMS]; |
| 503 | | | unsigned int i, j; |
| 504 | | | struct priorityq *pq; |
| 505 | | | pool_t pool; |
| 506 | | | int prev; |
| 507 | | | bool success = TRUE; |
Event 1:
!0 evaluates to true.
hide
|
|
| 508 | | | |
| 509 | | | pool = pool_alloconly_create("priorityq items", 1024); |
| 510 | | | |
| 511 | | | |
| 512 | | | for (i = 0; input[i] != -1; i++) { |
| 513 | | | p_clear(pool); |
| 514 | | | pq = priorityq_init(cmp_int, 1); |
| 515 | | | for (j = 0; input[i] != -1; i++, j++) { |
| 516 | | | if (priorityq_count(pq) != j) |
| 517 | | | success = FALSE; |
| 518 | | | item = p_new(pool, struct pq_test_item, 1);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/mempool.h |
| |
84 | #define p_new(pool, type, count) \ |
85 | ((type *) p_malloc(pool, sizeof(type) * (count))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/mempool.h |
| |
87 | #define p_malloc(pool, size) (pool)->v->malloc(pool, size) |
| |
|
| 519 | | | item->num = input[i]; |
| 520 | | | priorityq_add(pq, &item->item); |
| 521 | | | } |
| 522 | | | for (j = 0; j < N_ELEMENTS(output); j++) {
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
18 | #define N_ELEMENTS(arr) \ |
19 | (sizeof(arr) / sizeof((arr)[0])) |
| |
|
| 523 | | | if (priorityq_count(pq) != N_ELEMENTS(output) - j)
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
18 | #define N_ELEMENTS(arr) \ |
19 | (sizeof(arr) / sizeof((arr)[0])) |
| |
|
| 524 | | | success = FALSE; |
| 525 | | | |
| 526 | | | item = (struct pq_test_item *)priorityq_peek(pq); |
| 527 | | | if (output[j] != item->num) |
| 528 | | | success = FALSE; |
| 529 | | | item = (struct pq_test_item *)priorityq_pop(pq); |
| 530 | | | if (output[j] != item->num) |
| 531 | | | success = FALSE; |
| 532 | | | } |
| 533 | | | if (priorityq_count(pq) != 0) |
| 534 | | | success = FALSE; |
| 535 | | | if (priorityq_peek(pq) != NULL || priorityq_pop(pq) != NULL) |
| 536 | | | success = FALSE; |
| 537 | | | priorityq_deinit(&pq); |
| 538 | | | } |
| 539 | | | test_out("priorityq(1)", success); |
| 540 | | | |
| 541 | | | |
| 542 | | | success = TRUE; |
Event 4:
!0 evaluates to true.
hide
|
|
| 543 | | | for (i = 0; i < 100; i++) { |
Event 5:
Entering loop body. i < 100 evaluates to true.
hide
|
|
| 544 | | | pq = priorityq_init(cmp_int, 1); |
| 545 | | | for (j = 0; j < PQ_MAX_ITEMS; j++) { |
| 546 | | | items[j].num = rand(); |
| 547 | | | priorityq_add(pq, &items[j].item); |
| 548 | | | } |
| 549 | | | for (j = 0; j < PQ_MAX_ITEMS; j++) { |
| 550 | | | if (rand() % 3 == 0) { |
| 551 | | | priorityq_remove(pq, &items[j].item); |
| 552 | | | items[j].num = -1; |
| 553 | | | } |
| 554 | | | } |
| 555 | | | prev = 0; |
| 556 | [+] | | while (priorityq_count(pq) > 0) { |
 |
| 557 | [+] | | item = (struct pq_test_item *)priorityq_pop(pq); |
 |
| 558 | | | if (item->num < 0 || prev > item->num) |
Null Pointer Dereference
item is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 15. Show: All events | Only primary events |
|
| 559 | | | success = FALSE; |
| 560 | | | prev = item->num; |
| 561 | | | item->num = -1; |
| |