Fix bug in priority queue remove function

The short circuit in the remove function when the element is the last in the
heap, failed to add the removed slot back to the freelist.

Fixes #22644

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22646)

diff --git a/ssl/priority_queue.c b/ssl/priority_queue.c
index ab2442aeae72ab611c662c030c89569ba8415390..5393c532a7addb6d85014015a48e4c170af8ae9c 100644 (file)
--- a/ssl/priority_queue.c
+++ b/ssl/priority_queue.c
@@ -265,8 +265,14 @@ void *ossl_pqueue_remove(OSSL_PQUEUE *pq, size_t elem)
 
     ASSERT_USED(pq, n);
 
-    if (n == pq->htop - 1)
+    if (n == pq->htop - 1) {
+        pq->elements[elem].posn = pq->freelist;
+        pq->freelist = elem;
+#ifndef NDEBUG
+        pq->elements[elem].used = 0;
+#endif
         return pq->heap[--pq->htop].data;
+    }
     if (n > 0)
         pqueue_force_bottom(pq, n);
     return ossl_pqueue_pop(pq);