From 7bb55ed099f611ec7077db69684a6cb93d42dc70 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sun, 24 Mar 2019 00:22:38 +0900 Subject: [PATCH] util: fix condition_free_list_type() This fixes a bug introduced by c4f58deab56282cd438922203287cb073b861513. Closes oss-fuzz#13878, oss-fuzz#13882, oss-fuzz#13884, oss-fuzz#13886, and oss-fuzz#13888. --- src/shared/condition.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/shared/condition.c b/src/shared/condition.c index 69d65fffbc..32a90bcea3 100644 --- a/src/shared/condition.c +++ b/src/shared/condition.c @@ -77,17 +77,17 @@ void condition_free(Condition *c) { free(c); } -Condition* condition_free_list_type(Condition *first, ConditionType type) { - Condition *c, *n, *r = NULL; +Condition* condition_free_list_type(Condition *head, ConditionType type) { + Condition *c, *n; - LIST_FOREACH_SAFE(conditions, c, n, first) - if (type < 0 || c->type == type) + LIST_FOREACH_SAFE(conditions, c, n, head) + if (type < 0 || c->type == type) { + LIST_REMOVE(conditions, head, c); condition_free(c); - else if (!r) - r = c; + } - assert(type >= 0 || !r); - return r; + assert(type >= 0 || !head); + return head; } static int condition_test_kernel_command_line(Condition *c) {