util: fix condition_free_list_type()

This fixes a bug introduced by c4f58deab56282cd438922203287cb073b861513.

Closes oss-fuzz#13878, oss-fuzz#13882, oss-fuzz#13884, oss-fuzz#13886, and
oss-fuzz#13888.

diff --git a/src/shared/condition.c b/src/shared/condition.c
index 69d65fffbce0187b9eb368250d14767543992475..32a90bcea36adf7b6e9ce752f4b8bbdc4714be9c 100644 (file)
--- a/src/shared/condition.c
+++ b/src/shared/condition.c
@@ -77,17 +77,17 @@ void condition_free(Condition *c) {
         free(c);
 }
 
-Condition* condition_free_list_type(Condition *first, ConditionType type) {
-        Condition *c, *n, *r = NULL;
+Condition* condition_free_list_type(Condition *head, ConditionType type) {
+        Condition *c, *n;
 
-        LIST_FOREACH_SAFE(conditions, c, n, first)
-                if (type < 0 || c->type == type)
+        LIST_FOREACH_SAFE(conditions, c, n, head)
+                if (type < 0 || c->type == type) {
+                        LIST_REMOVE(conditions, head, c);
                         condition_free(c);
-                else if (!r)
-                        r = c;
+                }
 
-        assert(type >= 0 || !r);
-        return r;
+        assert(type >= 0 || !head);
+        return head;
 }
 
 static int condition_test_kernel_command_line(Condition *c) {