(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/mbox/mbox-sync.c) |
| |
| 357 | | | static void mbox_sync_update_flags(struct mbox_sync_mail_context *mail_ctx, |
| 358 | | | const struct mail_index_record *rec) |
| 359 | | | { |
| 360 | | | struct mbox_sync_context *sync_ctx = mail_ctx->sync_ctx; |
| 361 | | | struct mailbox *box = &sync_ctx->mbox->ibox.box; |
| 362 | | | struct mbox_sync_mail *mail = &mail_ctx->mail; |
| 363 | | | enum mail_index_sync_type sync_type; |
| 364 | | | ARRAY_TYPE(keyword_indexes) orig_keywords = ARRAY_INIT; |
| 365 | | | uint8_t flags, orig_flags; |
| 366 | | | |
| 367 | | | if (rec != NULL) { |
Event 1:
Skipping " if". rec != (void *)0 evaluates to false.
hide
Event 2:
Considering the case where rec must have been equal to 0.
hide
|
|
| 368 | | | if ((rec->flags & MAIL_INDEX_MAIL_FLAG_DIRTY) != 0) { |
| 369 | | | |
| 370 | | | |
| 371 | | | mbox_sync_get_dirty_flags(mail_ctx, rec); |
| 372 | | | } |
| 373 | | | } |
| 374 | | | |
| 375 | | | flags = orig_flags = mail->flags & MAIL_FLAGS_NONRECENT; |
| 376 | [+] | | if (array_is_created(&mail->keywords)) {
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
91 | #define array_is_created(array) \ |
92 | array_is_created_i(&(array)->arr) |
| |
|
 |
| 377 | | | t_array_init(&orig_keywords, 32);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
39 | #define t_array_init(array, init_count) \ |
40 | p_array_init(array, pool_datastack_create(), init_count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
35 | #define p_array_init(array, pool, init_count) \ |
36 | array_create(array, pool, sizeof(**(array)->v), init_count) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
75 | #define array_create(array, pool, element_size, init_count) \ |
76 | array_create_i(&(array)->arr, pool, element_size, init_count) |
| |
|
| 378 | | | array_append_array(&orig_keywords, &mail->keywords);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
126 | #define array_append_array(dest_array, src_array) \ |
127 | array_append_array_i(&(dest_array)->arr, &(src_array)->arr) |
| |
|
| 379 | | | } |
| 380 | | | |
| 381 | | | |
| 382 | | | index_sync_changes_apply(sync_ctx->sync_changes, |
| 383 | | | sync_ctx->mail_keyword_pool, |
| 384 | [+] | | &flags, &mail->keywords, &sync_type); |
 |
| 385 | | | if (flags != orig_flags || |
Event 6:
Taking true branch. flags != orig_flags evaluates to true.
hide
|
|
| 386 | | | !index_keyword_array_cmp(&mail->keywords, &orig_keywords)) { |
| 387 | | | mail_ctx->need_rewrite = TRUE; |
Event 7:
!0 evaluates to true.
hide
|
|
| 388 | | | mail->flags = flags | (mail->flags & MAIL_RECENT) | |
| 389 | | | MAIL_INDEX_MAIL_FLAG_DIRTY; |
| 390 | | | } |
| 391 | | | if (sync_type != 0 && box->v.sync_notify != NULL) { |
| 392 | | | box->v.sync_notify(box, rec->uid, |
Null Pointer Dereference
rec is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related event 2. Show: All events | Only primary events |
|
| 393 | | | index_sync_type_convert(sync_type)); |
| |