From: Pauli <pauli@openssl.org>
Date: Mon, 6 Nov 2023 20:32:18 +0000 (+1100)
Subject: Fix bug in priority queue remove function
X-Git-Tag: openssl-3.3.0-alpha1~653
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a03108778044cc0d428ce38084ef6f318446fbe3;p=thirdparty%2Fopenssl.git

Fix bug in priority queue remove function

The short circuit in the remove function when the element is the last in the
heap, failed to add the removed slot back to the freelist.

Fixes #22644

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22646)
---

diff --git a/ssl/priority_queue.c b/ssl/priority_queue.c
index ab2442aeae7..5393c532a7a 100644
--- a/ssl/priority_queue.c
+++ b/ssl/priority_queue.c
@@ -265,8 +265,14 @@ void *ossl_pqueue_remove(OSSL_PQUEUE *pq, size_t elem)
 
     ASSERT_USED(pq, n);
 
-    if (n == pq->htop - 1)
+    if (n == pq->htop - 1) {
+        pq->elements[elem].posn = pq->freelist;
+        pq->freelist = elem;
+#ifndef NDEBUG
+        pq->elements[elem].used = 0;
+#endif
         return pq->heap[--pq->htop].data;
+    }
     if (n > 0)
         pqueue_force_bottom(pq, n);
     return ossl_pqueue_pop(pq);