(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/istream-seekable.c) |
| |
| 270 | | | struct istream * |
| 271 | | | i_stream_create_seekable(struct istream *input[], |
| 272 | | | size_t max_buffer_size, |
| 273 | | | int (*fd_callback)(const char **path_r, void *context), |
| 274 | | | void *context) |
| 275 | | | { |
| 276 | | | struct seekable_istream *sstream; |
| 277 | | | const unsigned char *data; |
| 278 | | | unsigned int count; |
| 279 | | | size_t size; |
| 280 | | | bool blocking = TRUE; |
Event 1:
!0 evaluates to true.
hide
|
|
| 281 | | | |
| 282 | | | |
| 283 | | | for (count = 0; input[count] != NULL; count++) { |
Event 2:
Entering loop body. input[count] != (void *)0 evaluates to true.
hide
|
|
| 284 | | | if (!input[count]->seekable) |
Event 3:
Taking true branch. input[count]->seekable evaluates to false.
hide
|
|
| 285 | | | break; |
| 286 | | | } |
| 287 | | | if (input[count] == NULL) |
Event 4:
Skipping " if". input[count] == (void *)0 evaluates to false.
hide
|
|
| 288 | | | return i_stream_create_concat(input); |
| 289 | | | |
| 290 | | | |
| 291 | | | for (count = 0; input[count] != NULL; count++) { |
Event 6:
During loop iterations, count is set to count + 1, which evaluates to an unknown [ ?unknown: the analysis lost precision when tracking this value, so this warning may be a false positive] value . - Determines the allocation size later.
hide
Event 7:
Continuing from loop body. Entering loop body. input[count] != (void *)0 evaluates to true.
hide
Event 9:
count is set to count + 1, which evaluates to the value assigned to count, plus 2. See related event 6.
hide
Event 10:
Continuing from loop body. Leaving loop. input[count] != (void *)0 evaluates to false.
hide
|
|
| 292 | | | if (!input[count]->blocking) |
Event 8:
Skipping " if". input[count]->blocking evaluates to true.
hide
|
|
| 293 | | | blocking = FALSE; |
| 294 | | | i_stream_ref(input[count]); |
| 295 | | | } |
| 296 | | | i_assert(count != 0);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 11:
Skipping " if". count != 0 evaluates to true.
hide
Event 12:
Skipping " if". !(count != 0) evaluates to false.
hide
Event 13:
Skipping " if". !!(count != 0) evaluates to true.
hide
Event 14:
Skipping " if". !!!(count != 0) evaluates to false.
hide
Event 15:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 297 | | | |
| 298 | | | sstream = i_new(struct seekable_istream, 1);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/imem.h |
| |
8 | #define i_new(type, count) ((type *) i_malloc(sizeof(type) * (count))) |
| |
|
| 299 | | | sstream->fd_callback = fd_callback; |
| 300 | | | sstream->context = context; |
| 301 | | | sstream->buffer = buffer_create_dynamic(default_pool, BUF_INITIAL_SIZE); |
| 302 | | | sstream->istream.max_buffer_size = max_buffer_size; |
| 303 | | | |
| 304 | [+] | | sstream->input = i_new(struct istream *, count + 1);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/imem.h |
| |
8 | #define i_new(type, count) ((type *) i_malloc(sizeof(type) * (count))) |
| |
|
Event 16:
4 * count + 4, which evaluates to the value assigned to count at istream-seekable.c:291, times 4, plus 12, is passed to i_malloc(). - This multiplication may overflow and it is used as the allocation size later.
See related event 9.
hide
|
|
 |
| |