(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib-index/mail-index-map.c) |
| |
| 112 | | | int mail_index_map_ext_get_next(struct mail_index_map *map, |
| 113 | | | unsigned int *offset_p, |
| 114 | | | const struct **ext_hdr_r, |
| 115 | | | const char **name_r) |
| 116 | | | { |
| 117 | | | const struct *ext_hdr; |
| 118 | | | unsigned int offset, name_offset; |
| 119 | | | |
| 120 | | | offset = *offset_p; |
| 121 | | | *name_r = ""; |
| 122 | | | |
| 123 | | | |
| 124 | | | |
| 125 | | | |
| 126 | | | |
| 127 | | | |
| 128 | | | |
| 129 | | | |
| 130 | | | name_offset = offset + sizeof(*ext_hdr); |
| 131 | | | ext_hdr = CONST_PTR_OFFSET(map->hdr_base, offset);
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
| 132 | | | if (offset + sizeof(*ext_hdr) >= map->hdr.) |
Event 1:
Skipping " if". offset + sizeof( *ext_hdr ) >= map->hdr. evaluates to false.
hide
|
|
| 133 | | | return -1; |
| 134 | | | |
| 135 | | | offset += mail_index_map_ext_hdr_offset(ext_hdr->name_size); |
| 136 | | | if (offset > map->hdr.) |
Event 2:
Skipping " if". offset > map->hdr. evaluates to false.
hide
|
|
| 137 | | | return -1; |
| 138 | | | |
| 139 | | | *name_r = t_strndup(CONST_PTR_OFFSET(map->hdr_base, name_offset),
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/macros.h |
| |
29 | #define CONST_PTR_OFFSET(ptr, offset) \ |
30 | ((const void *) (((const unsigned char *) (ptr)) + (offset))) |
| |
|
Event 11:
*name_r is set to t_strndup(...), which evaluates to NULL. See related event 10.
hide
|
|
| 140 | [+] | | ext_hdr->name_size); |
 |
| 141 | | | if (strcmp(*name_r, str_sanitize(*name_r, -1)) != 0) { |
Event 12:
*name_r, which evaluates to NULL, is passed to strcmp() as the first argument. See related event 11.
hide
Null Pointer Dereference
The body of strcmp() dereferences *name_r, but it is NULL. The issue can occur if the highlighted code executes. See related event 12. Show: All events | Only primary events |
|
| |