From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sat, 23 Mar 2019 15:22:38 +0000 (+0900)
Subject: util: fix condition_free_list_type()
X-Git-Tag: v242-rc1~76^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7bb55ed099f611ec7077db69684a6cb93d42dc70;p=thirdparty%2Fsystemd.git

util: fix condition_free_list_type()

This fixes a bug introduced by c4f58deab56282cd438922203287cb073b861513.

Closes oss-fuzz#13878, oss-fuzz#13882, oss-fuzz#13884, oss-fuzz#13886, and
oss-fuzz#13888.
---

diff --git a/src/shared/condition.c b/src/shared/condition.c
index 69d65fffbce..32a90bcea36 100644
--- a/src/shared/condition.c
+++ b/src/shared/condition.c
@@ -77,17 +77,17 @@ void condition_free(Condition *c) {
         free(c);
 }
 
-Condition* condition_free_list_type(Condition *first, ConditionType type) {
-        Condition *c, *n, *r = NULL;
+Condition* condition_free_list_type(Condition *head, ConditionType type) {
+        Condition *c, *n;
 
-        LIST_FOREACH_SAFE(conditions, c, n, first)
-                if (type < 0 || c->type == type)
+        LIST_FOREACH_SAFE(conditions, c, n, head)
+                if (type < 0 || c->type == type) {
+                        LIST_REMOVE(conditions, head, c);
                         condition_free(c);
-                else if (!r)
-                        r = c;
+                }
 
-        assert(type >= 0 || !r);
-        return r;
+        assert(type >= 0 || !head);
+        return head;
 }
 
 static int condition_test_kernel_command_line(Condition *c) {