Fix broken list-munging in ecpg's remove_variables().

tglsfdc · tglsfdc · commit 2f696453d2b3 · 2024-12-01T14:15:37.000-05:00
The loops over cursor argument variables neglected to ever advance "prevvar". The code would accidentally do the right thing anyway when removing the first or second list entry, but if it had to remove the third or later entry then it would also remove all entries between there and the first entry. AFAICS this would only matter for cursors that reference out-of-scope variables, which is a weird Informix compatibility hack; between that and the lack of impact for short lists, it's not so surprising that nobody has complained. Nonetheless it's a pretty obvious bug. It would have been more obvious if these loops used a more standard coding style for chasing the linked lists --- this business with the "prev" pointer sometimes pointing at the current list entry is confusing and overcomplicated. So rather than just add a minimal band-aid, I chose to rewrite the loops in the same style we use elsewhere, where the "prev" pointer is NULL until we are dealing with a non-first entry and we save the "next" pointer at the top of the loop. (Two of the four loops touched here are not actually buggy, but it seems better to make them all look alike.) Coverity discovered this problem, but not until 2b41de4 added code to free no-longer-needed arguments structs. With that, the incorrect link updates are possibly touching freed memory, and it complained about that. Nonetheless the list corruption hazard is ancient, so back-patch to all supported branches.
diff --git a/src/interfaces/ecpg/preproc/variable.c b/src/interfaces/ecpg/preproc/variable.c
@@ -264,17 +264,19 @@ void
 remove_typedefs(int brace_level)
 {
 	struct typedefs *p,
-			   *prev;
+			   *prev,
+			   *next;
 
-	for (p = prev = types; p;)
+	for (p = types, prev = NULL; p; p = next)
 	{
+		next = p->next;
 		if (p->brace_level >= brace_level)
 		{
 			/* remove it */
-			if (p == types)
-				prev = types = p->next;
+			if (prev)
+				prev->next = next;
 			else
-				prev->next = p->next;
+				types = next;
 
 			if (p->type->type_enum == ECPGt_struct || p->type->type_enum == ECPGt_union)
 				ECPGfree_struct_member(p->struct_member_list);
@@ -286,30 +288,25 @@ remove_typedefs(int brace_level)
 			free(p->type);
 			free(p->name);
 			free(p);
-			if (prev == types)
-				p = types;
-			else
-				p = prev ? prev->next : NULL;
 		}
 		else
-		{
 			prev = p;
-			p = prev->next;
-		}
 	}
 }
 
 void
 remove_variables(int brace_level)
 {
 	struct variable *p,
-			   *prev;
+			   *prev,
+			   *next;
 
-	for (p = prev = allvariables; p;)
+	for (p = allvariables, prev = NULL; p; p = next)
 	{
+		next = p->next;
 		if (p->brace_level >= brace_level)
 		{
-			/* is it still referenced by a cursor? */
+			/* remove it, but first remove any references from cursors */
 			struct cursor *ptr;
 
 			for (ptr = cur; ptr != NULL; ptr = ptr->next)
@@ -318,53 +315,52 @@ remove_variables(int brace_level)
 						   *prevvar,
 						   *nextvar;
 
-				for (varptr = prevvar = ptr->argsinsert; varptr != NULL; varptr = nextvar)
+				for (varptr = ptr->argsinsert, prevvar = NULL;
+					 varptr != NULL; varptr = nextvar)
 				{
 					nextvar = varptr->next;
 					if (p == varptr->variable)
 					{
 						/* remove from list */
-						if (varptr == ptr->argsinsert)
-							ptr->argsinsert = varptr->next;
+						if (prevvar)
+							prevvar->next = nextvar;
 						else
-							prevvar->next = varptr->next;
+							ptr->argsinsert = nextvar;
 						free(varptr);
 					}
+					else
+						prevvar = varptr;
 				}
-				for (varptr = prevvar = ptr->argsresult; varptr != NULL; varptr = nextvar)
+				for (varptr = ptr->argsresult, prevvar = NULL;
+					 varptr != NULL; varptr = nextvar)
 				{
 					nextvar = varptr->next;
 					if (p == varptr->variable)
 					{
 						/* remove from list */
-						if (varptr == ptr->argsresult)
-							ptr->argsresult = varptr->next;
+						if (prevvar)
+							prevvar->next = nextvar;
 						else
-							prevvar->next = varptr->next;
+							ptr->argsresult = nextvar;
 						free(varptr);
 					}
+					else
+						prevvar = varptr;
 				}
 			}
 
 			/* remove it */
-			if (p == allvariables)
-				prev = allvariables = p->next;
+			if (prev)
+				prev->next = next;
 			else
-				prev->next = p->next;
+				allvariables = next;
 
 			ECPGfree_type(p->type);
 			free(p->name);
 			free(p);
-			if (prev == allvariables)
-				p = allvariables;
-			else
-				p = prev ? prev->next : NULL;
 		}
 		else
-		{
 			prev = p;
-			p = prev->next;
-		}
 	}
 }
 
