From: Stefan Eissing <icing@apache.org>
Date: Thu, 21 Apr 2022 10:31:37 +0000 (+0000)
Subject:   *) mod_http2: fix edge case in removal of entries
X-Git-Tag: 2.5.0-alpha2-ci-test-only~373
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1c1d4824722daefb62bc19cfce23b6ad81aeb3f4;p=thirdparty%2Fapache%2Fhttpd.git

  *) mod_http2: fix edge case in removal of entries
     in a h2_fifo.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1900102 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/http2/h2_util.c b/modules/http2/h2_util.c
index ef0062885e6..467d01db2f9 100644
--- a/modules/http2/h2_util.c
+++ b/modules/http2/h2_util.c
@@ -817,7 +817,7 @@ apr_status_t h2_fifo_remove(h2_fifo *fifo, void *elem)
                         fifo->out -= fifo->capacity;
                     }
                 }
-                else if (i + 1 == fifo->in) {
+                else if (((i + 1) % fifo->capacity) == fifo->in) {
                     /* last element */
                     --fifo->in;
                     if (fifo->in < 0) {
@@ -835,6 +835,8 @@ apr_status_t h2_fifo_remove(h2_fifo *fifo, void *elem)
                 }
                 else {
                     /* we wrapped around, move elements above down */
+                    AP_DEBUG_ASSERT((fifo->in - i - 1) > 0);
+                    AP_DEBUG_ASSERT((fifo->in - i - 1) < fifo->capacity);
                     memmove(&fifo->elems[i], &fifo->elems[i + 1],
                             (fifo->in - i - 1) * sizeof(void*));
                     --fifo->in;