Fix elements not being removed in otpd_queue_pop_msgid()

If the element being removed were not the queue head,
otpd_queue_pop_msgid() would not actually remove the element, leading
to potential double frees and request replays.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
This commit is contained in:
Robbie Harwood 2018-05-30 14:54:54 -04:00 committed by Rob Crittenden
parent 3e4b9cd969
commit a2e8d989a3

View File

@ -155,7 +155,7 @@ struct otpd_queue_item *otpd_queue_pop_msgid(struct otpd_queue *q, int msgid)
for (item = q->head, prev = &q->head;
item != NULL;
item = item->next, prev = &item->next) {
prev = &item->next, item = item->next) {
if (item->msgid == msgid) {
*prev = item->next;
if (q->head == NULL)