(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-storage/index/shared/shared-storage.c) |
| |
| 41 | | | static int shared_create(struct mail_storage *_storage, const char *data, |
| 42 | | | const char **error_r) |
| 43 | | | { |
| 44 | | | struct shared_storage *storage = (struct shared_storage *)_storage; |
| 45 | | | struct mailbox_list_settings list_set; |
| 46 | | | const char *driver, *p; |
| 47 | | | char *wildcardp; |
| 48 | | | bool have_username; |
| 49 | | | |
| 50 | | | |
| 51 | | | p = strchr(data, ':'); |
| 52 | | | if (p == NULL) { |
Event 1:
Skipping " if". p == (void *)0 evaluates to false.
hide
|
|
| 53 | | | *error_r = "Shared mailbox location not prefixed with driver"; |
| 54 | | | return -1; |
| 55 | | | } |
| 56 | | | driver = t_strdup_until(data, p); |
| 57 | | | storage->location = p_strdup(_storage->pool, data); |
| 58 | | | storage->storage_class = mail_storage_find_class(driver); |
| 59 | | | if (storage->storage_class == NULL) { |
Event 2:
Skipping " if". storage->storage_class == (void *)0 evaluates to false.
hide
|
|
| 60 | | | *error_r = t_strconcat("Unknown shared storage driver: ", |
| 61 | | | driver, NULL); |
| 62 | | | return -1; |
| 63 | | | } |
| 64 | | | _storage->mailbox_is_file = storage->storage_class->mailbox_is_file; |
| 65 | | | |
| 66 | | | wildcardp = strchr(_storage->ns->prefix, '%'); |
| 67 | | | if (wildcardp == NULL) { |
Event 3:
Skipping " if". wildcardp == (void *)0 evaluates to false.
hide
|
|
| 68 | | | *error_r = "Shared namespace prefix doesn't contain %"; |
| 69 | | | return -1; |
| 70 | | | } |
| 71 | | | storage->ns_prefix_pattern = p_strdup(_storage->pool, wildcardp); |
| 72 | | | |
| 73 | | | have_username = FALSE; |
| 74 | | | for (p = storage->ns_prefix_pattern; *p != '\0'; p++) { |
| 75 | | | if (*p != '%') |
| 76 | | | continue; |
| 77 | | | if (*++p == '\0') |
| 78 | | | break; |
| 79 | | | if (*p == 'u' || *p == 'n') |
| 80 | | | have_username = TRUE; |
| 81 | | | else if (*p != '%' && *p != 'd') |
| 82 | | | break; |
| 83 | | | } |
| 84 | | | if (*p != '\0') { |
Event 5:
Skipping " if". *p != 0 evaluates to false.
hide
|
|
| 85 | | | *error_r = "Shared namespace prefix contains unknown variables"; |
| 86 | | | return -1; |
| 87 | | | } |
| 88 | | | if (!have_username) { |
Event 6:
Skipping " if". have_username evaluates to true.
hide
|
|
| 89 | | | *error_r = "Shared namespace prefix doesn't contain %u or %n"; |
| 90 | | | return -1; |
| 91 | | | } |
| 92 | | | |
| 93 | | | |
| 94 | | | |
| 95 | | | *wildcardp = '\0'; |
| 96 | | | |
| 97 | [+] | | if (mailbox_list_alloc("shared", &_storage->list, error_r) < 0) |
 |
| 98 | | | return -1; |
| 99 | | | MODULE_CONTEXT_SET_FULL(_storage->list, shared_mailbox_list_module,
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/module-context.h |
| |
87 | #define MODULE_CONTEXT_SET_FULL(obj, id_ctx, ctx, module_ctx) STMT_START { \ |
88 | void *_module_tmp = ctx + \ |
89 | COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(module_ctx, \ |
90 | (**(obj)->module_contexts.v)) + \ |
91 | OBJ_REGISTER_COMPATIBLE(obj, id_ctx); \ |
92 | array_idx_set_i(&(obj)->module_contexts.arr, \ |
93 | module_get_context_id(&(id_ctx).id), &_module_tmp); \ |
94 | } STMT_END |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
158 | # define COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(_a, _b) \ |
159 | COMPILE_ERROR_IF_TRUE( \ |
160 | !__builtin_types_compatible_p(typeof(_a), typeof(_b))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
156 | # define COMPILE_ERROR_IF_TRUE(condition) \ |
157 | (sizeof(char[1 - 2 * !!(condition)]) - 1) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/module-context.h |
| |
43 | #define OBJ_REGISTER_COMPATIBLE(obj, id_ctx) \ |
44 | COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(OBJ_REGISTER(obj), (id_ctx).reg) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
158 | # define COMPILE_ERROR_IF_TYPES_NOT_COMPATIBLE(_a, _b) \ |
159 | COMPILE_ERROR_IF_TRUE( \ |
160 | !__builtin_types_compatible_p(typeof(_a), typeof(_b))) |
| |
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
156 | # define COMPILE_ERROR_IF_TRUE(condition) \ |
157 | (sizeof(char[1 - 2 * !!(condition)]) - 1) |
| |
|
| 100 | | | storage, &storage->list_module_ctx); |
| 101 | | | |
| 102 | | | memset(&list_set, 0, sizeof(list_set)); |
Event 9:
0 is passed to memset() as the second argument. - Dereferenced later, causing the null pointer dereference.
hide
Event 10:
&list_set.root_dir is passed to memset() as the first argument.
hide
Event 11:
Inside memset(), list_set is set to NULL, where &list_set is &list_set.root_dir. See related events 9 and 10.
hide
|
|
| 103 | | | list_set.mail_storage_flags = &_storage->flags; |
| 104 | | | list_set.lock_method = &_storage->lock_method; |
| 105 | | | mailbox_list_init(_storage->list, _storage->ns, &list_set, |
Event 12:
&list_set, which evaluates to &list_set.root_dir, is passed to mailbox_list_init() as the third argument.
hide
|
|
| 106 | [+] | | mail_storage_get_list_flags(_storage->flags)); |
 |
| |