(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/fts-squat/squat-trie.c) |
| |
| 1609 | | | static int squat_trie_write(struct squat_trie_build_context *ctx) |
| 1610 | | | { |
| 1611 | | | struct squat_trie *trie = ctx->trie; |
| 1612 | | | struct file_lock *file_lock = NULL; |
| 1613 | | | struct ostream *output; |
| 1614 | | | const char *path; |
| 1615 | | | int fd = -1, ret = 0; |
| 1616 | | | |
| 1617 | | | if ((trie->hdr.used_file_size > sizeof(trie->hdr) && |
Event 1:
Taking true branch. - trie->hdr.used_file_size > sizeof( trie->hdr ) evaluates to true.
- trie->unmapped_child_count < trie->hdr.node_count / 4 evaluates to true.
hide
|
|
| 1618 | | | trie->unmapped_child_count < trie->hdr.node_count/4) || 1) { |
| 1619 | | | |
| 1620 | | | ctx->compress_nodes = TRUE; |
Event 2:
!0 evaluates to true.
hide
|
|
| 1621 | | | |
| 1622 | [+] | | path = t_strconcat(trie->path, ".tmp", NULL); |
 |
| 1623 | [+] | | fd = squat_trie_create_fd(trie, path, O_TRUNC);
x /usr/include/bits/fcntl.h |
| |
41 | #define O_TRUNC 01000 /* not fcntl */ |
| |
|
 |
| 1624 | | | if (fd == -1) |
Event 12:
Skipping " if". fd == -1 evaluates to false.
hide
|
|
| 1625 | | | return -1; |
| 1626 | | | |
| 1627 | | | if (trie->lock_method != FILE_LOCK_METHOD_DOTLOCK) { |
Event 13:
Skipping " if". trie->lock_method != FILE_LOCK_METHOD_DOTLOCK evaluates to false.
hide
|
|
| 1628 | | | ret = file_wait_lock(fd, path, F_WRLCK,
x /usr/include/bits/fcntl.h |
| |
133 | #define F_WRLCK 1 /* Write lock. */ |
| |
|
| 1629 | | | trie->lock_method, |
| 1630 | | | SQUAT_TRIE_LOCK_TIMEOUT, |
| 1631 | | | &file_lock); |
| 1632 | | | if (ret <= 0) { |
| 1633 | | | if (ret == 0) { |
| 1634 | | | i_error("file_wait_lock(%s) failed: %m", |
| 1635 | | | path); |
| 1636 | | | } |
| 1637 | | | (void)close(fd); |
| 1638 | | | return -1; |
| 1639 | | | } |
| 1640 | | | } |
| 1641 | | | |
| 1642 | | | output = o_stream_create_fd(fd, 0, FALSE); |
| 1643 | | | o_stream_cork(output); |
| 1644 | | | o_stream_send(output, &trie->hdr, sizeof(trie->hdr)); |
| 1645 | | | } else { |
| 1646 | | | |
| 1647 | | | path = trie->path; |
| 1648 | | | ctx->compress_nodes = |
| 1649 | | | trie->hdr.used_file_size == sizeof(trie->hdr); |
| 1650 | | | |
| 1651 | | | if (trie->hdr.used_file_size == 0) { |
| 1652 | | | |
| 1653 | | | if (squat_trie_write_lock(ctx) < 0) |
| 1654 | | | return -1; |
| 1655 | | | } |
| 1656 | | | output = o_stream_create_fd(trie->fd, 0, FALSE); |
| 1657 | | | o_stream_cork(output); |
| 1658 | | | |
| 1659 | | | if (trie->hdr.used_file_size != 0) |
| 1660 | | | o_stream_seek(output, trie->hdr.used_file_size); |
| 1661 | | | else |
| 1662 | | | o_stream_send(output, &trie->hdr, sizeof(trie->hdr)); |
| 1663 | | | } |
| 1664 | | | |
| 1665 | | | ctx->output = output; |
| 1666 | | | ret = squat_write_nodes(ctx); |
| 1667 | | | ctx->output = NULL; |
| 1668 | | | |
| 1669 | | | |
| 1670 | | | |
| 1671 | | | o_stream_send(output, "", 1); |
| 1672 | | | |
| 1673 | | | if (trie->corrupted) |
Event 14:
Skipping " if". trie->corrupted evaluates to false.
hide
|
|
| 1674 | | | ret = -1; |
| 1675 | | | if (ret == 0) |
Event 15:
Taking true branch. ret == 0 evaluates to true.
hide
|
|
| 1676 | [+] | | ret = squat_trie_write_lock(ctx); |
 |
| 1677 | | | if (ret == 0) { |
Event 18:
Taking true branch. ret == 0 evaluates to true.
hide
|
|
| 1678 | | | trie->hdr.used_file_size = output->offset; |
| 1679 | | | o_stream_seek(output, 0); |
| 1680 | | | o_stream_send(output, &trie->hdr, sizeof(trie->hdr)); |
| 1681 | | | } |
| 1682 | | | if (output->last_failed_errno != 0) { |
Event 19:
Skipping " if". output->last_failed_errno != 0 evaluates to false.
hide
|
|
| 1683 | | | errno = output->last_failed_errno; |
| 1684 | | | i_error("write() to %s failed: %m", path); |
| 1685 | | | ret = -1; |
| 1686 | | | } |
| 1687 | | | o_stream_destroy(&output); |
| 1688 | | | |
| 1689 | | | if (fd == -1) { |
Event 20:
Skipping " if". fd == -1 evaluates to false.
hide
|
|
| 1690 | | | |
| 1691 | | | i_assert(file_lock == NULL);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 1692 | | | return ret; |
| 1693 | | | } |
| 1694 | | | |
| 1695 | | | |
| 1696 | | | if (ret < 0) { |
Event 21:
Taking false branch. ret < 0 evaluates to false.
hide
|
|
| 1697 | | | if (close(fd) < 0) |
| 1698 | | | i_error("close(%s) failed: %m", path); |
| 1699 | | | fd = -1; |
| 1700 | | | } else if (rename(path, trie->path) < 0) { |
Event 22:
path, which evaluates to NULL, is passed to rename() as the first argument. See related event 8.
hide
Null Pointer Dereference
The body of rename() dereferences path, but it is NULL. The issue can occur if the highlighted code executes. See related event 22. Show: All events | Only primary events |
|
| |