Bix list concat should set head box to NULL if it's freed

diff --git a/src/include/value.h b/src/include/value.h
index 1034ad94c3d002c0473469dcfee53cfdeed43ec4..4ecfdfbe96793ea4b46df1ec325428086465836a 100644 (file)
--- a/src/include/value.h
+++ b/src/include/value.h
@@ -497,7 +497,7 @@ int         fr_value_box_from_str(TALLOC_CTX *ctx, fr_value_box_t *dst,
  *     Lists
  */
 int            fr_value_box_list_concat(TALLOC_CTX *ctx,
-                                        fr_value_box_t *out, fr_value_box_t *list,
+                                        fr_value_box_t *out, fr_value_box_t **list,
                                         fr_type_t type, bool free_input);
 
 void           fr_value_box_list_free(fr_value_box_t **head);

diff --git a/src/lib/util/value.c b/src/lib/util/value.c
index 06a823fc13bd89084c9d2ff7fd8ee1140d365924..d020f3f2c70cd94708e24cf26c76f1501848b45a 100644 (file)
--- a/src/lib/util/value.c
+++ b/src/lib/util/value.c
@@ -3664,13 +3664,13 @@ char *fr_value_box_list_asprint(TALLOC_CTX *ctx, fr_value_box_t const *head, cha
  *     - -1 on failure.
  */
 int fr_value_box_list_concat(TALLOC_CTX *ctx,
-                            fr_value_box_t *out, fr_value_box_t *list, fr_type_t type, bool free_input)
+                            fr_value_box_t *out, fr_value_box_t **list, fr_type_t type, bool free_input)
 {
        TALLOC_CTX              *pool;
        fr_cursor_t             cursor;
        fr_value_box_t const    *vb;
 
-       if (!list) {
+       if (!list || !*list) {
                fr_strerror_printf("Invalid arguments.  List was NULL");
                return -1;
        }
@@ -3686,13 +3686,13 @@ int fr_value_box_list_concat(TALLOC_CTX *ctx,
                return -1;
        }
 
-       fr_cursor_init(&cursor, &list);
+       fr_cursor_init(&cursor, list);
 
        /*
         *      Allow concatenating in place
         */
-       if (out == list) {
-               if (list->type != type) {
+       if (out == *list) {
+               if ((*list)->type != type) {
                        fr_value_box_t from_cast;
                        fr_value_box_t *next = out->next;
 
@@ -3706,7 +3706,7 @@ int fr_value_box_list_concat(TALLOC_CTX *ctx,
                }
                fr_cursor_next(&cursor);
        } else {
-               if (fr_value_box_cast(ctx, out, type, NULL, list) < 0) return -1;       /* Decomposes to copy */
+               if (fr_value_box_cast(ctx, out, type, NULL, *list) < 0) return -1;      /* Decomposes to copy */
 
                if (free_input) {
                        fr_cursor_free_item(&cursor);           /* Advances cursor */