(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-mail/message-decoder.c) |
| |
| 249 | | | static bool message_decode_body(struct message_decoder_context *ctx, |
| 250 | | | struct message_block *input, |
| 251 | | | struct message_block *output) |
| 252 | | | { |
| 253 | | | unsigned char new_buf[MAX_ENCODING_BUF_SIZE+1]; |
| 254 | | | const unsigned char *data = NULL; |
Event 1:
data is set to NULL. - Dereferenced later, causing the null pointer dereference.
hide
|
|
| 255 | | | size_t pos, size = 0, skip = 0; |
| 256 | | | int ret; |
| 257 | | | |
| 258 | | | if (ctx->encoding_size != 0) { |
Event 2:
Skipping " if". ctx->encoding_size != 0 evaluates to false.
hide
|
|
| 259 | | | |
| 260 | | | memcpy(new_buf, ctx->encoding_buf, ctx->encoding_size); |
| 261 | | | skip = sizeof(new_buf) - ctx->encoding_size; |
| 262 | | | if (skip > input->size) |
| 263 | | | skip = input->size; |
| 264 | | | memcpy(new_buf + ctx->encoding_size, input->data, skip); |
| 265 | | | } |
| 266 | | | |
| 267 | | | switch (ctx->content_type) { |
Event 3:
ctx->content_type evaluates to implicit-default.
hide
|
|
| 268 | | | case CONTENT_TYPE_UNKNOWN: |
| 269 | | | |
| 270 | | | return FALSE; |
| 271 | | | |
| 272 | | | case CONTENT_TYPE_BINARY: |
| 273 | | | data = input->data; |
| 274 | | | size = pos = input->size; |
| 275 | | | break; |
| 276 | | | case CONTENT_TYPE_QP: |
| 277 | | | buffer_set_used_size(ctx->buf, 0); |
| 278 310 |  | | [ Lines 278 to 310 omitted. ] |
| 311 | | | if (ret == 0) { |
| 312 | | | |
| 313 | | | pos = input->size - skip; |
| 314 | | | } |
| 315 | | | pos += skip; |
| 316 | | | data = ctx->buf->data; |
| 317 | | | size = ctx->buf->used; |
| 318 | | | break; |
| 319 | | | } |
| 320 | | | |
| 321 | | | if (pos != input->size) { |
Event 4:
Taking false branch. pos != input->size evaluates to false.
hide
|
|
| 322 | | | |
| 323 | | | i_assert(pos < input->size);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 324 | | | ctx->encoding_size = input->size - pos; |
| 325 | | | i_assert(ctx->encoding_size <= sizeof(ctx->encoding_buf));
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 326 | | | memcpy(ctx->encoding_buf, input->data + pos, |
| 327 | | | ctx->encoding_size); |
| 328 | | | } else { |
| 329 | | | ctx->encoding_size = 0; |
| 330 | | | } |
| 331 | | | |
| 332 | | | if (ctx->binary_input) { |
Event 5:
Taking false branch. ctx->binary_input evaluates to false.
hide
|
|
| 333 | | | output->data = data; |
| 334 | | | output->size = size; |
| 335 | | | } else if (ctx->charset_utf8) { |
Event 6:
Taking false branch. ctx->charset_utf8 evaluates to false.
hide
|
|
| 336 | | | buffer_set_used_size(ctx->buf2, 0); |
| 337 | | | if ((ctx->flags & MESSAGE_DECODER_FLAG_DTCASE) != 0) { |
| 338 | | | (void)uni_utf8_to_decomposed_titlecase(data, size, |
| 339 | | | ctx->buf2); |
| 340 | | | output->data = ctx->buf2->data; |
| 341 | | | output->size = ctx->buf2->used; |
| 342 | | | } else if (uni_utf8_get_valid_data(data, size, ctx->buf2)) { |
| 343 | | | output->data = data; |
| 344 | | | output->size = size; |
| 345 | | | } else { |
| 346 | | | output->data = ctx->buf2->data; |
| 347 | | | output->size = ctx->buf2->used; |
| 348 | | | } |
| 349 | | | } else if (ctx->charset_trans == NULL) { |
Event 7:
Taking false branch. ctx->charset_trans == (void *)0 evaluates to false.
hide
|
|
| 350 | | | |
| 351 | | | buffer_set_used_size(ctx->buf2, 0); |
| 352 | | | if (uni_utf8_get_valid_data(data, size, ctx->buf2)) { |
| 353 | | | output->data = data; |
| 354 | | | output->size = size; |
| 355 | | | } else { |
| 356 | | | output->data = ctx->buf2->data; |
| 357 | | | output->size = ctx->buf2->used; |
| 358 | | | } |
| 359 | | | } else { |
| 360 | | | buffer_set_used_size(ctx->buf2, 0); |
| 361 | | | if (ctx->translation_size != 0) |
Event 8:
Taking true branch. ctx->translation_size != 0 evaluates to true.
hide
|
|
| 362 | [+] | | translation_buf_decode(ctx, &data, &size); |
Event 9:
&data is passed to translation_buf_decode() as the second argument.
hide
|
|
 |
| |