(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/maildir/maildir-uidlist.c) |
| |
| 1199 | | | static int maildir_uidlist_recreate(struct maildir_uidlist *uidlist) |
| 1200 | | | { |
| 1201 | | | struct mailbox *box = &uidlist->ibox->box; |
| 1202 | | | const char *control_dir, *temp_path; |
| 1203 | | | struct stat st; |
| 1204 | | | mode_t old_mask; |
| 1205 | | | uoff_t file_size; |
| 1206 | | | int i, fd, ret; |
| 1207 | | | |
| 1208 | | | i_assert(uidlist->initial_read);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
189 | #define i_assert(expr) STMT_START{ \ |
190 | if (unlikely(!(expr))) \ |
191 | i_panic("file %s: line %d (%s): assertion failed: (%s)", \ |
192 | __FILE__, \ |
193 | __LINE__, \ |
194 | __PRETTY_FUNCTION__, \ |
195 | #expr); }STMT_END |
| |
|
Event 1:
Skipping " if". !uidlist->initial_read evaluates to false.
hide
Event 2:
Skipping " if". !!uidlist->initial_read evaluates to true.
hide
Event 3:
Skipping " if". !!!uidlist->initial_read evaluates to false.
hide
Event 4:
Skipping " if". __builtin_expect(...) evaluates to false.
hide
|
|
| 1209 | | | |
| 1210 | | | control_dir = mailbox_list_get_path(box->storage->list, box->name, |
| 1211 | | | MAILBOX_LIST_PATH_TYPE_CONTROL); |
| 1212 | | | temp_path = t_strconcat(control_dir, |
Event 10:
temp_path is set to t_strconcat(...), which evaluates to NULL. See related event 9.
hide
|
|
| 1213 | [+] | | "/" MAILDIR_UIDLIST_NAME ".tmp", NULL); |
 |
| 1214 | | | |
| 1215 | | | for (i = 0;; i++) { |
| 1216 | | | old_mask = umask(0777 & ~box->file_create_mode); |
| 1217 | | | fd = open(temp_path, O_RDWR | O_CREAT | O_TRUNC, 0777);
x /usr/include/bits/fcntl.h |
| |
38 | #define O_CREAT 0100 /* not fcntl */ |
| |
x /usr/include/bits/fcntl.h |
| |
41 | #define O_TRUNC 01000 /* not fcntl */ |
| |
|
| 1218 | | | umask(old_mask); |
| 1219 | | | if (fd != -1) |
Event 12:
Taking true branch. fd != -1 evaluates to true.
hide
|
|
| 1220 | | | break; |
| 1221 | | | |
| 1222 | | | if (errno != ENOENT || i == MAILDIR_DELETE_RETRY_COUNT ||
x /usr/include/asm-generic/errno-base.h |
| |
5 | #define ENOENT 2 /* No such file or directory */ |
| |
|
| 1223 | | | uidlist->mbox == NULL) { |
| 1224 | | | mail_storage_set_critical(box->storage, |
| 1225 | | | "open(%s, O_CREAT) failed: %m", temp_path); |
| 1226 | | | return -1; |
| 1227 | | | } |
| 1228 | | | |
| 1229 | | | |
| 1230 | | | if (!maildir_set_deleted(uidlist->mbox)) |
| 1231 | | | return -1; |
| 1232 | | | } |
| 1233 | | | |
| 1234 | | | if (box->file_create_gid != (gid_t)-1 && |
Event 13:
Skipping " if". box->file_create_gid != (gid_t)-1 evaluates to false.
hide
|
|
| 1235 | | | fchown(fd, (uid_t)-1, box->file_create_gid) < 0) { |
| 1236 | | | if (errno == EPERM) {
x /usr/include/asm-generic/errno-base.h |
| |
4 | #define EPERM 1 /* Operation not permitted */ |
| |
|
| 1237 | | | mail_storage_set_critical(box->storage, "%s", |
| 1238 | | | eperm_error_get_chgrp("fchown", temp_path, |
| 1239 | | | box->file_create_gid, |
| 1240 | | | box->file_create_gid_origin)); |
| 1241 | | | } else { |
| 1242 | | | mail_storage_set_critical(box->storage, |
| 1243 | | | "fchown(%s) failed: %m", temp_path); |
| 1244 | | | } |
| 1245 | | | } |
| 1246 | | | |
| 1247 | | | uidlist->read_records_count = 0; |
| 1248 | [+] | | ret = maildir_uidlist_write_fd(uidlist, fd, temp_path, 0, &file_size); |
 |
| 1249 | | | if (ret == 0) { |
Event 28:
Skipping " if". ret == 0 evaluates to false.
hide
|
|
| 1250 | | | if (rename(temp_path, uidlist->path) < 0) { |
| 1251 | | | mail_storage_set_critical(box->storage, |
| 1252 | | | "rename(%s, %s) failed: %m", |
| 1253 | | | temp_path, uidlist->path); |
| 1254 | | | ret = -1; |
| 1255 | | | } |
| 1256 | | | } |
| 1257 | | | |
| 1258 | | | if (ret < 0) { |
Event 29:
Taking true branch. ret < 0 evaluates to true.
hide
|
|
| 1259 | | | if (unlink(temp_path) < 0) { |
Event 30:
temp_path, which evaluates to NULL, is passed to unlink(). See related event 10.
hide
Null Pointer Dereference
The body of unlink() dereferences temp_path, but it is NULL. The issue can occur if the highlighted code executes. See related event 30. Show: All events | Only primary events |
|
| |