Fixed Bug #63581 Possible null dereference

remicollet · remicollet · commit f08060a48fad · 2012-11-28T10:28:18.000+01:00
Possible NULL dereference when trying to delete the single item
of a list (ack from fat).

This issues where found from by static code analysis tool and,
so, I can't provide any reproducer.
diff --git a/sapi/fpm/fpm/fpm_events.c b/sapi/fpm/fpm/fpm_events.c
@@ -188,7 +188,9 @@ static int fpm_event_queue_del(struct fpm_event_queue_s **queue, struct fpm_even
 			}
 			if (q == *queue) {
 				*queue = q->next;
-				(*queue)->prev = NULL;
+				if (*queue) {
+					(*queue)->prev = NULL;
+				}
 			}
 
 			/* ask the event module to remove the fd from its own queue */
@@ -432,7 +434,9 @@ void fpm_event_loop(int err) /* {{{ */
 						}
 						if (q == fpm_event_queue_timer) {
 							fpm_event_queue_timer = q->next;
-							fpm_event_queue_timer->prev = NULL;
+							if (fpm_event_queue_timer) {
+								fpm_event_queue_timer->prev = NULL;
+							}
 						}
 						q = q->next;
 						free(q2);

Original file line number	Diff line number	Diff line change
`@@ -188,7 +188,9 @@ static int fpm_event_queue_del(struct fpm_event_queue_s **queue, struct fpm_even`
`188`	`188`	`}`
`189`	`189`	`if (q == *queue) {`
`190`	`190`	`*queue = q->next;`
`191`		`- (*queue)->prev = NULL;`
	`191`	`+ if (*queue) {`
	`192`	`+ (*queue)->prev = NULL;`
	`193`	`+ }`
`192`	`194`	`}`
`193`	`195`
`194`	`196`	`/* ask the event module to remove the fd from its own queue */`
`@@ -432,7 +434,9 @@ void fpm_event_loop(int err) /* {{{ */`
`432`	`434`	`}`
`433`	`435`	`if (q == fpm_event_queue_timer) {`
`434`	`436`	`fpm_event_queue_timer = q->next;`
`435`		`- fpm_event_queue_timer->prev = NULL;`
	`437`	`+ if (fpm_event_queue_timer) {`
	`438`	`+ fpm_event_queue_timer->prev = NULL;`
	`439`	`+ }`
`436`	`440`	`}`
`437`	`441`	`q = q->next;`
`438`	`442`	`free(q2);`