(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/imap/imap-sync.c) |
| |
| 682 | | | bool cmd_sync_delayed(struct client *client) |
| 683 | | | { |
| 684 | | | struct client_command_context *cmd, *first_expunge, *first_nonexpunge; |
| 685 | | | |
| 686 | | | if (client->output_lock != NULL) { |
Event 1:
Skipping " if". client->output_lock != (void *)0 evaluates to false.
hide
|
|
| 687 | | | |
| 688 | | | return FALSE; |
| 689 | | | } |
| 690 | | | |
| 691 | [+] | | if (!imap_sync_is_allowed(client)) { |
 |
| 692 | | | |
| 693 | | | return cmd_sync_drop_fast(client); |
| 694 | | | } |
| 695 | | | |
| 696 | | | |
| 697 | | | first_expunge = first_nonexpunge = NULL; |
| 698 | | | for (cmd = client->command_queue; cmd != NULL; cmd = cmd->next) { |
Event 6:
cmd is set to client->command_queue.
hide
Event 7:
Entering loop body. cmd != (void *)0 evaluates to true.
hide
Event 10:
Continuing from loop body. Leaving loop. cmd != (void *)0 evaluates to false.
hide
|
|
| 699 | | | if (cmd->sync != NULL && |
Event 8:
Skipping " if". cmd->sync != (void *)0 evaluates to false.
hide
Event 9:
Considering the case where cmd->sync is equal to 0 so client->command_queue->sync must have been equal to 0. See related event 6.
hide
|
|
| 700 | | | cmd->sync->counter == client->sync_counter) { |
| 701 | | | if (cmd->sync->flags & MAILBOX_SYNC_FLAG_NO_EXPUNGES) { |
| 702 | | | if (first_nonexpunge == NULL) |
| 703 | | | first_nonexpunge = cmd; |
| 704 | | | } else { |
| 705 | | | if (first_expunge == NULL) |
| 706 | | | first_expunge = cmd; |
| 707 | | | } |
| 708 | | | } |
| 709 | | | } |
| 710 | | | if (first_expunge != NULL && first_nonexpunge != NULL) { |
Event 11:
Skipping " if". first_expunge != (void *)0 evaluates to false.
hide
|
|
| 711 | | | |
| 712 | | | for (cmd = first_expunge; cmd != NULL; cmd = cmd->next) { |
| 713 | | | if (cmd->sync != NULL && |
| 714 | | | cmd->sync->counter == client->sync_counter && |
| 715 | | | (cmd->sync->flags & |
| 716 | | | MAILBOX_SYNC_FLAG_NO_EXPUNGES) == 0) |
| 717 | | | cmd->sync->counter++; |
| 718 | | | } |
| 719 | | | first_expunge = NULL; |
| 720 | | | } |
| 721 | | | cmd = first_nonexpunge != NULL ? first_nonexpunge : first_expunge; |
Event 12:
first_nonexpunge != (void *)0 evaluates to false.
hide
|
|
| 722 | | | |
| 723 | | | if (cmd == NULL) |
Event 13:
Taking true branch. cmd == (void *)0 evaluates to true.
hide
|
|
| 724 | [+] | | return cmd_sync_drop_fast(client); |
Event 14:
client is passed to cmd_sync_drop_fast(). - Dereferenced later, causing the null pointer dereference.
hide
|
|
 |
| |