From 006986b0f004b4cdbc3620b417d5a7f62931ecb6 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 30 May 2018 14:54:54 -0400 Subject: [PATCH] Fix elements not being removed in otpd_queue_pop_msgid() If the element being removed were not the queue head, otpd_queue_pop_msgid() would not actually remove the element, leading to potential double frees and request replays. Reviewed-By: Alexander Bokovoy Reviewed-By: Stanislav Laznicka --- daemons/ipa-otpd/queue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/daemons/ipa-otpd/queue.c b/daemons/ipa-otpd/queue.c index 730bbc40b864b9dc65a69049c0a0e516e3daac0e..9e29fb238d5c7a7395bcf3860ce7445c27ca98ac 100644 --- a/daemons/ipa-otpd/queue.c +++ b/daemons/ipa-otpd/queue.c @@ -155,7 +155,7 @@ struct otpd_queue_item *otpd_queue_pop_msgid(struct otpd_queue *q, int msgid) for (item = q->head, prev = &q->head; item != NULL; - item = item->next, prev = &item->next) { + prev = &item->next, item = item->next) { if (item->msgid == msgid) { *prev = item->next; if (q->head == NULL) -- 2.17.1