(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/dbox/dbox-sync-file.c) |
| |
| 410 | | | int dbox_sync_file(struct dbox_sync_context *ctx, |
| 411 | | | const struct dbox_sync_file_entry *entry) |
| 412 | | | { |
| 413 | | | struct dbox_file *file; |
| 414 | | | struct dbox_index_record *rec; |
| 415 | | | enum dbox_index_file_status status; |
| 416 | | | bool locked, deleted; |
| 417 | | | int ret; |
| 418 | | | |
| 419 | | | if ((entry->file_id & DBOX_FILE_ID_FLAG_UID) != 0) { |
Event 1:
Taking true branch. (entry->file_id & 2147483648) != 0 evaluates to true.
hide
|
|
| 420 | | | locked = TRUE; |
Event 2:
!0 evaluates to true.
hide
|
|
| 421 | | | status = DBOX_INDEX_FILE_STATUS_SINGLE_MESSAGE; |
| 422 | | | } else { |
| 423 | | | rec = dbox_index_record_lookup(ctx->mbox->dbox_index, |
| 424 | | | entry->file_id); |
| 425 | | | if (rec == NULL || |
| 426 | | | rec->status == DBOX_INDEX_FILE_STATUS_UNLINKED) { |
| 427 | | | |
| 428 | | | return 1; |
| 429 | | | } |
| 430 | | | locked = rec->locked; |
| 431 | | | status = rec->status; |
| 432 | | | } |
| 433 | | | |
| 434 | [+] | | file = dbox_file_init(ctx->mbox, entry->file_id); |
Event 3:
The resource of interest is allocated inside dbox_file_init().
hide
|
|
 |
| 435 | | | if ((status == DBOX_INDEX_FILE_STATUS_SINGLE_MESSAGE || |
| 436 | | | status == DBOX_INDEX_FILE_STATUS_MAILDIR) && |
| 437 | | | array_is_created(&entry->expunges)) {
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
91 | #define array_is_created(array) \ |
92 | array_is_created_i(&(array)->arr) |
| |
|
| 438 | | | |
| 439 | [+] | | if (dbox_sync_file_unlink(file) < 0) |
Event 21:
The resource of interest is passed to dbox_sync_file_unlink(). - dbox_sync_file_unlink() does not free it or save any references that are freed later.
- file, which evaluates to malloc(size) from imem.c:9, is passed to dbox_sync_file_unlink().
See related event 19.
hide
|
|
 |
| 440 | | | ret = -1; |
| 441 | | | else { |
| 442 | | | dbox_sync_mark_single_file_expunged(ctx, entry); |
| 443 | | | ret = 1; |
| 444 | | | } |
| 445 | | | } else { |
| 446 | | | ret = dbox_file_open_or_create(file, TRUE, &deleted); |
| 447 | | | if (ret > 0 && !deleted) { |
| 448 | | | dbox_sync_file_move_if_needed(ctx, file, entry); |
| 449 | | | ret = dbox_sync_file_int(ctx, file, entry, locked); |
| 450 | | | } |
| 451 | | | } |
| 452 | [+] | | dbox_file_unref(&file); |
Event 27:
&file is passed to dbox_file_unref().
hide
|
|
 |
| |