(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-index/mail-cache-compress.c) |
| |
| 113 | | | mail_cache_compress_get_fields(struct mail_cache_copy_context *ctx, |
| 114 | | | unsigned int used_fields_count) |
| 115 | | | { |
| 116 | | | struct mail_cache *cache = ctx->cache; |
Event 1:
cache is set to ctx->cache.
hide
|
|
| 117 | | | struct mail_cache_field *field; |
| 118 | | | unsigned int i, j, idx; |
| 119 | | | |
| 120 | | | |
| 121 | | | |
| 122 | | | memcpy(cache->field_file_map, ctx->field_file_map, |
| 123 | | | sizeof(uint32_t) * cache->fields_count); |
| 124 | | | |
| 125 | | | |
| 126 | | | cache->file_fields_count = used_fields_count; |
| 127 | | | i_free(cache->file_field_map);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/imem.h |
| |
14 | #define i_free(mem) \ |
15 | STMT_START { \ |
16 | free(mem); \ |
17 | (mem) = NULL; \ |
18 | } STMT_END |
| |
|
| 128 | | | cache->file_field_map = used_fields_count == 0 ? NULL : |
Event 2:
used_fields_count == 0 evaluates to true.
hide
|
|
| 129 | | | i_new(unsigned int, used_fields_count);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/imem.h |
| |
8 | #define i_new(type, count) ((type *) i_malloc(sizeof(type) * (count))) |
| |
|
Event 3:
cache->file_field_map is set to used_fields_count == 0 ? (void *)0 : (unsigned int *)i_malloc(...), which evaluates to NULL, where cache is ctx->cache. - Dereferenced later, causing the null pointer dereference.
See related event 1.
hide
|
|
| 130 | | | for (i = j = 0; i < cache->fields_count; i++) { |
Event 4:
Entering loop body. i < cache->fields_count evaluates to true.
hide
|
|
| 131 | | | idx = cache->field_file_map[i]; |
| 132 | | | if (idx != (uint32_t)-1) { |
Event 5:
Taking true branch. idx != (uint32_t)-1 evaluates to true.
hide
|
|
| 133 | | | i_assert(idx < used_fields_count &&
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
| 134 | | | cache->file_field_map[idx] == 0); |
Event 6:
idx < used_fields_count evaluates to true.
hide
Null Pointer Dereference
cache->file_field_map is dereferenced here, but it is NULL. The issue can occur if the highlighted code executes. See related events 1 and 3. Show: All events | Only primary events |
|
| |