(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/virtual/virtual-sync.c) |
| |
| 1047 | | | static void virtual_sync_backend_map_uids(struct virtual_sync_context *ctx) |
| 1048 | | | { |
| 1049 | | | uint32_t virtual_ext_id = ctx->mbox->virtual_ext_id; |
| 1050 | | | struct virtual_sync_mail *vmails; |
| 1051 | | | struct virtual_backend_box *bbox, *const *bboxes; |
| 1052 | | | struct virtual_backend_uidmap *uidmap = NULL; |
| 1053 | | | struct virtual_add_record add_rec; |
| 1054 | | | const struct virtual_mail_index_record *vrec; |
| 1055 | | | const void *data; |
| 1056 | | | bool expunged; |
| 1057 | | | uint32_t i, vseq, vuid, messages, count; |
| 1058 | | | unsigned int j = 0, uidmap_count = 0; |
| 1059 | | | |
| 1060 | [+] | | messages = mail_index_view_get_messages_count(ctx->sync_view); |
 |
| 1061 | | | |
| 1062 | | | |
| 1063 | | | |
| 1064 | | | vmails = messages == 0 ? NULL : |
Event 3:
messages == 0 evaluates to false.
hide
|
|
| 1065 | [+] | | i_new(struct virtual_sync_mail, messages);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/imem.h |
| |
8 | #define i_new(type, count) ((type *) i_malloc(sizeof(type) * (count))) |
| |
|
Event 4:
12 * messages, which evaluates to 12 * view->v.get_messages_count(...) from mail-index-view.c:472, is passed to i_malloc(). - This multiplication may overflow and it is used as the allocation size later.
See related event 2.
hide
|
|
 |
| |