(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/lazy-expunge/lazy-expunge-plugin.c) |
| |
| 568 | | | lazy_expunge_hook_mail_namespaces_created(struct mail_namespace *namespaces) |
| 569 | | | { |
| 570 | | | struct lazy_expunge_mail_user *luser = |
| 571 | | | LAZY_EXPUNGE_USER_CONTEXT(namespaces->user);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/lazy-expunge/lazy-expunge-plugin.c |
| |
23 | #define LAZY_EXPUNGE_USER_CONTEXT(obj) \ |
24 | MODULE_CONTEXT(obj, lazy_expunge_mail_user_module) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/module-context.h |
| |
46 | #define MODULE_CONTEXT(obj, id_ctx) \ |
47 | (*((void **)array_idx_modifiable(&(obj)->module_contexts, \ |
48 | (id_ctx).id.module_id) + \ |
49 | OBJ_REGISTER_COMPATIBLE(obj, id_ctx))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
179 | #define array_idx_modifiable(array, idx) \ |
180 | ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
181 | array_idx_modifiable_i(&(array)->arr, idx) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/array.h |
| |
45 | # define ARRAY_TYPE_CAST_MODIFIABLE(array) \ |
46 | (typeof(*(array)->v_modifiable)) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/module-context.h |
| |
43 | #define OBJ_REGISTER_COMPATIBLE(obj, id_ctx) \ |
44 | COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(OBJ_REGISTER(obj), (id_ctx).reg) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
158 | # define COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(_a, _b) \ |
159 | COMPILE_ERROR_IF_TRUE( \ |
160 | !__builtin_types_compatible_p(typeof(_a), typeof(_b))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
156 | # define COMPILE_ERROR_IF_TRUE(condition) \ |
157 | (sizeof(char[1 - 2 * !!(condition)]) - 1) |
| |
|
| 572 | | | struct lazy_expunge_mail_storage *lstorage; |
| 573 | | | const char *const *p; |
| 574 | | | int i; |
| 575 | | | |
| 576 | [+] | | p = t_strsplit_spaces(getenv("LAZY_EXPUNGE"), " "); |
Event 1:
getenv() returns NULL. - Dereferenced later, causing the null pointer dereference.
hide
Event 2:
getenv("LAZY_EXPUNGE"), which evaluates to NULL, is passed to t_strsplit_spaces() as the first argument. See related event 1.
hide
|
|
 |
| |