(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-index/mail-cache-fields.c) |
| |
| 68 | | | void mail_cache_register_fields(struct mail_cache *cache, |
| 69 | | | struct mail_cache_field *fields, |
| 70 | | | unsigned int fields_count) |
| 71 | | | { |
| 72 | | | void *orig_key, *orig_value; |
| 73 | | | char *name; |
| 74 | | | unsigned int new_idx; |
| 75 | | | unsigned int i, j; |
| 76 | | | |
| 77 | | | new_idx = cache->fields_count; |
Event 1:
new_idx is set to cache->fields_count. - Determines the allocation size later.
hide
|
|
| 78 | | | for (i = 0; i < fields_count; i++) { |
Event 2:
Entering loop body. i < fields_count evaluates to true.
hide
Event 7:
Continuing from loop body. Leaving loop. i < fields_count evaluates to false.
hide
|
|
| 79 | | | if (hash_table_lookup_full(cache->field_name_hash, |
| 80 | | | fields[i].name, |
| 81 | | | &orig_key, &orig_value)) { |
Event 3:
Skipping " if". hash_table_lookup_full(...) evaluates to false.
hide
|
|
| 82 | | | i_assert(fields[i].type < MAIL_CACHE_FIELD_COUNT);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 83 | | | |
| 84 | | | fields[i].idx = |
| 85 | | | POINTER_CAST_TO(orig_value, unsigned int);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
49 | #define POINTER_CAST_TO(p, type) \ |
50 | ((type) ((const char *) (p) - (const char *) NULL)) |
| |
|
| 86 | | | (void)field_type_verify(cache, fields[i].idx, |
| 87 | | | fields[i].type, |
| 88 | | | fields[i].field_size); |
| 89 | | | continue; |
| 90 | | | } |
| 91 | | | |
| 92 | | | |
| 93 | | | |
| 94 | | | for (j = 0; j < i; j++) { |
Event 4:
Leaving loop. j < i evaluates to false.
hide
|
|
| 95 | | | if (strcasecmp(fields[i].name, fields[j].name) == 0) { |
| 96 | | | fields[i].idx = fields[j].idx; |
| 97 | | | break; |
| 98 | | | } |
| 99 | | | } |
| 100 | | | |
| 101 | | | if (j == i) |
Event 5:
Taking true branch. j == i evaluates to true.
hide
|
|
| 102 | | | fields[i].idx = new_idx++; |
Event 6:
new_idx is set to new_idx + 1, which evaluates to cache->fields_count + 1. See related event 1.
hide
|
|
| 103 | | | } |
| 104 | | | |
| 105 | | | if (new_idx == cache->fields_count) |
Event 8:
Skipping " if". new_idx == cache->fields_count evaluates to false.
hide
|
|
| 106 | | | return; |
| 107 | | | |
| 108 | | | |
| 109 | | | cache->fields = i_realloc(cache->fields, |
| 110 | | | cache->fields_count * sizeof(*cache->fields), |
| 111 | [+] | | new_idx * sizeof(*cache->fields)); |
Event 9:
32 * new_idx, which evaluates to 32 * cache->fields_count + 32, is passed to i_realloc() as the third argument. - This multiplication may overflow and it is used as the allocation size later.
See related event 6.
hide
|
|
 |
| |