(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/fts-squat/squat-trie.c) |
| |
| 1609 | | | static int squat_trie_write(struct squat_trie_build_context *ctx) |
| 1610 | | | { |
| 1611 | | | struct squat_trie *trie = ctx->trie; |
| 1612 | | | struct file_lock *file_lock = NULL; |
| 1613 | | | struct ostream *output; |
| 1614 | | | const char *path; |
| 1615 | | | int fd = -1, ret = 0; |
| 1616 | | | |
| 1617 | | | if ((trie->hdr.used_file_size > sizeof(trie->hdr) && |
Event 1:
Taking true branch. - trie->hdr.used_file_size > sizeof( trie->hdr ) evaluates to false.
- 1 evaluates to true.
hide
|
|
| 1618 | | | trie->unmapped_child_count < trie->hdr.node_count/4) || 1) { |
| 1619 | | | |
| 1620 | | | ctx->compress_nodes = TRUE; |
Event 2:
!0 evaluates to true.
hide
|
|
| 1621 | | | |
| 1622 | [+] | | path = t_strconcat(trie->path, ".tmp", NULL); |
 |
| 1623 | [+] | | fd = squat_trie_create_fd(trie, path, O_TRUNC);
x /usr/include/bits/fcntl.h |
| |
41 | #define O_TRUNC 01000 /* not fcntl */ |
| |
|
 |
| 1624 | | | if (fd == -1) |
Event 38:
Skipping " if". fd == -1 evaluates to false.
hide
|
|
| 1625 | | | return -1; |
| 1626 | | | |
| 1627 | | | if (trie->lock_method != FILE_LOCK_METHOD_DOTLOCK) { |
Event 39:
Skipping " if". trie->lock_method != FILE_LOCK_METHOD_DOTLOCK evaluates to false.
hide
|
|
| 1628 | | | ret = file_wait_lock(fd, path, F_WRLCK,
x /usr/include/bits/fcntl.h |
| |
133 | #define F_WRLCK 1 /* Write lock. */ |
| |
|
| 1629 | | | trie->lock_method, |
| 1630 | | | SQUAT_TRIE_LOCK_TIMEOUT, |
| 1631 | | | &file_lock); |
| 1632 | | | if (ret <= 0) { |
| 1633 | | | if (ret == 0) { |
| 1634 | | | i_error("file_wait_lock(%s) failed: %m", |
| 1635 | | | path); |
| 1636 | | | } |
| 1637 | | | (void)close(fd); |
| 1638 | | | return -1; |
| 1639 | | | } |
| 1640 | | | } |
| 1641 | | | |
| 1642 | | | output = o_stream_create_fd(fd, 0, FALSE); |
| 1643 | | | o_stream_cork(output); |
| 1644 | | | o_stream_send(output, &trie->hdr, sizeof(trie->hdr)); |
| 1645 | | | } else { |
| 1646 | | | |
| 1647 | | | path = trie->path; |
| 1648 | | | ctx->compress_nodes = |
| 1649 | | | trie->hdr.used_file_size == sizeof(trie->hdr); |
| 1650 | | | |
| 1651 | | | if (trie->hdr.used_file_size == 0) { |
| 1652 | | | |
| 1653 | | | if (squat_trie_write_lock(ctx) < 0) |
| 1654 | | | return -1; |
| 1655 | | | } |
| 1656 | | | output = o_stream_create_fd(trie->fd, 0, FALSE); |
| 1657 | | | o_stream_cork(output); |
| 1658 | | | |
| 1659 | | | if (trie->hdr.used_file_size != 0) |
| 1660 | | | o_stream_seek(output, trie->hdr.used_file_size); |
| 1661 | | | else |
| 1662 | | | o_stream_send(output, &trie->hdr, sizeof(trie->hdr)); |
| 1663 | | | } |
| 1664 | | | |
| 1665 | | | ctx->output = output; |
| 1666 | | | ret = squat_write_nodes(ctx); |
| 1667 | | | ctx->output = NULL; |
| 1668 | | | |
| 1669 | | | |
| 1670 | | | |
| 1671 | | | o_stream_send(output, "", 1); |
| 1672 | | | |
| 1673 | | | if (trie->corrupted) |
Event 40:
Skipping " if". trie->corrupted evaluates to false.
hide
|
|
| 1674 | | | ret = -1; |
| 1675 | | | if (ret == 0) |
Event 41:
Taking true branch. ret == 0 evaluates to true.
hide
|
|
| 1676 | | | ret = squat_trie_write_lock(ctx); |
| 1677 | | | if (ret == 0) { |
Event 42:
Taking true branch. ret == 0 evaluates to true.
hide
|
|
| 1678 | | | trie->hdr.used_file_size = output->offset; |
| 1679 | | | o_stream_seek(output, 0); |
| 1680 | | | o_stream_send(output, &trie->hdr, sizeof(trie->hdr)); |
| 1681 | | | } |
| 1682 | | | if (output->last_failed_errno != 0) { |
Event 43:
Skipping " if". output->last_failed_errno != 0 evaluates to false.
hide
|
|
| 1683 | | | errno = output->last_failed_errno; |
| 1684 | | | i_error("write() to %s failed: %m", path); |
| 1685 | | | ret = -1; |
| 1686 | | | } |
| 1687 | | | o_stream_destroy(&output); |
| 1688 | | | |
| 1689 | | | if (fd == -1) { |
Event 44:
Skipping " if". fd == -1 evaluates to false.
hide
|
|
| 1690 | | | |
| 1691 | | | i_assert(file_lock == NULL);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 1692 | | | return ret; |
| 1693 | | | } |
| 1694 | | | |
| 1695 | | | |
| 1696 | | | if (ret < 0) { |
Event 45:
Taking false branch. ret < 0 evaluates to false.
hide
|
|
| 1697 | | | if (close(fd) < 0) |
| 1698 | | | i_error("close(%s) failed: %m", path); |
| 1699 | | | fd = -1; |
| 1700 | | | } else if (rename(path, trie->path) < 0) { |
Event 46:
path, which evaluates to the value assigned to ret at data-stack.c:335, is passed to rename() as the first argument. See related event 34.
hide
Event 47:
rename() accesses the file named path, where path is the value assigned to ret at data-stack.c:335. - The same name is used to access a file later, but it is not safe to assume that it will be the same underlying file.
See related event 46.
hide
Event 48:
Taking true branch. rename(path, trie->path) < 0 evaluates to true.
hide
|
|
| 1701 | | | i_error("rename(%s, %s) failed: %m", path, trie->path); |
| 1702 | | | ret = -1; |
| 1703 | | | } |
| 1704 | | | |
| 1705 | | | if (ret < 0) { |
Event 49:
Taking true branch. ret < 0 evaluates to true.
hide
|
|
| 1706 | | | if (unlink(path) < 0 && errno != ENOENT)
x /usr/include/asm-generic/errno-base.h |
| |
5 | #define ENOENT 2 /* No such file or directory */ |
| |
|
Event 50:
path, which evaluates to the value assigned to ret at data-stack.c:335, is passed to unlink(). See related event 34.
hide
File System Race Condition
The file named path is accessed again. Another process may have changed the file since the access at squat-trie.c:1700. For example, an attacker could replace the original file with a link to a file containing important or confidential data. The issue can occur if the highlighted code executes. See related events 47 and 50. Show: All events | Only primary events |
|
| |