(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/mbox/istream-raw-mbox.c) |
| |
| 169 | | | static ssize_t i_stream_raw_mbox_read(struct istream_private *stream) |
| 170 | | | { |
| 171 | | | static const char *mbox_from = "\nFrom "; |
| 172 | | | struct raw_mbox_istream *rstream = (struct raw_mbox_istream *)stream; |
| 173 | | | const unsigned char *buf; |
| 174 | | | const char *fromp; |
| 175 | | | char *sender; |
| 176 | | | time_t received_time; |
| 177 | | | size_t i, pos, new_pos, from_start_pos, from_after_pos; |
| 178 | | | ssize_t ret = 0; |
| 179 | | | int eoh_char, tz; |
| 180 | | | bool crlf_ending = FALSE; |
| 181 | | | |
| 182 | | | i_assert(rstream->seeked);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 1:
Skipping " if". !rstream->seeked evaluates to false.
hide
Event 2:
Skipping " if". !!rstream->seeked evaluates to true.
hide
Event 3:
Skipping " if". !!!rstream->seeked evaluates to false.
hide
Event 4:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 183 | | | i_assert(stream->istream.v_offset >= rstream->from_offset);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 5:
Skipping " if". stream->istream.v_offset >= rstream->from_offset evaluates to true.
hide
Event 6:
Skipping " if". !(stream->istream.v_offset >= rstream->from_offset) evaluates to false.
hide
Event 7:
Skipping " if". !!(stream->istream.v_offset >= rstream->from_offset) evaluates to true.
hide
Event 8:
Skipping " if". !!!(stream->istream.v_offset >= rstream->from_offset) evaluates to false.
hide
Event 9:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 184 | | | |
| 185 | | | if (stream->istream.eof) |
Event 10:
Skipping " if". stream->istream.eof evaluates to false.
hide
|
|
| 186 | | | return -1; |
| 187 | | | if (rstream->corrupted) { |
Event 11:
Skipping " if". rstream->corrupted evaluates to false.
hide
|
|
| 188 | | | rstream->istream.istream.stream_errno = EINVAL;
x /usr/include/asm-generic/errno-base.h |
| |
25 | #define EINVAL 22 /* Invalid argument */ |
| |
|
| 189 | | | return -1; |
| 190 | | | } |
| 191 | | | |
| 192 | | | i_stream_seek(stream->parent, stream->istream.v_offset); |
| 193 | | | |
| 194 | | | stream->pos -= stream->skip; |
| 195 | | | stream->skip = 0; |
| 196 | | | stream->buffer = NULL; |
| 197 | | | |
| 198 | | | ret = 0; |
| 199 | | | do { |
| 200 | [+] | | buf = i_stream_get_data(stream->parent, &pos); |
 |
| 201 | | | if (pos > 1 && stream->istream.v_offset + pos > |
Event 15:
Skipping " if". pos > 1 evaluates to false.
hide
|
|
| 202 | | | rstream->input_peak_offset) { |
| 203 | | | |
| 204 | | | |
| 205 | | | |
| 206 | | | |
| 207 | | | ret = pos; |
| 208 | | | break; |
| 209 | | | } |
| 210 | [+] | | ret = i_stream_read(stream->parent); |
 |
| 211 | | | } while (ret > 0); |
Event 25:
Leaving loop. ret > 0 evaluates to false.
hide
|
|
| 212 | | | stream->istream.stream_errno = stream->parent->stream_errno; |
| 213 | | | |
| 214 | | | if (ret < 0) { |
Event 26:
Skipping " if". ret < 0 evaluates to false.
hide
|
|
| 215 | | | if (ret == -2) { |
| 216 | | | if (stream->skip == stream->pos) { |
| 217 | | | |
| 218 | | | |
| 219 | | | } else if (stream->istream.v_offset + pos == |
| 220 | | | rstream->input_peak_offset) { |
| 221 | | | |
| 222 | | | |
| 223 | | | stream->buffer = buf; |
| 224 | | | return -2; |
| 225 247 |  | | [ Lines 225 to 247 omitted. ] |
| 248 | | | |
| 249 | | | rstream->eof = TRUE; |
| 250 | | | } |
| 251 | | | stream->istream.eof = TRUE; |
| 252 | | | rstream->crlf_ending = crlf_ending; |
| 253 | | | handle_end_of_mail(rstream, pos); |
| 254 | | | return ret < 0 ? i_stream_raw_mbox_read(stream) : ret; |
| 255 | | | } |
| 256 | | | } |
| 257 | | | |
| 258 | | | if (stream->istream.v_offset == rstream->from_offset) { |
Event 27:
Skipping " if". stream->istream.v_offset == rstream->from_offset evaluates to false.
hide
|
|
| 259 | | | |
| 260 | | | if (pos == 2 && ret > 0) { |
| 261 | | | |
| 262 | | | |
| 263 | | | rstream->input_peak_offset = |
| 264 | | | stream->istream.v_offset + pos; |
| 265 | | | return i_stream_raw_mbox_read(stream); |
| 266 | | | } |
| 267 | | | if (mbox_read_from_line(rstream) < 0) { |
| 268 | | | stream->pos = 0; |
| 269 | | | rstream->eof = TRUE; |
| 270 | | | rstream->corrupted = TRUE; |
| 271 | | | return -1; |
| 272 | | | } |
| 273 | | | |
| 274 | | | |
| 275 | | | |
| 276 | | | buf = i_stream_get_data(stream->parent, &pos); |
| 277 | | | if (pos == 0) |
| 278 | | | return i_stream_raw_mbox_read(stream); |
| 279 | | | } |
| 280 | | | |
| 281 | | | |
| 282 | | | |
| 283 | | | fromp = mbox_from; from_start_pos = from_after_pos = (size_t)-1; |
| 284 | | | eoh_char = rstream->body_offset == (uoff_t)-1 ? '\n' : -1; |
Event 28:
rstream->body_offset == (uoff_t)-1 evaluates to true.
hide
|
|
| 285 | | | for (i = stream->pos; i < pos; i++) { |
Event 29:
Entering loop body. i < pos evaluates to true.
hide
|
|
| 286 | | | if (buf[i] == eoh_char && |
Null Pointer Dereference
buf is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 14. Show: All events | Only primary events |
|
| |