From: Matt Caswell <matt@openssl.org>
Date: Wed, 15 Jan 2020 18:10:03 +0000 (+0000)
Subject: Fix init_thread_stop
X-Git-Tag: openssl-3.0.0-alpha1~637
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=2dd04ca881414779e847a21e6be4e428257c25f1;p=oweals%2Fopenssl.git

Fix init_thread_stop

init_thread_stop maintains a linked lists of handlers that it should
call when a thread finishes. The linked list handling wasn't quite right
resulting in corrupted data.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/10863)
---

diff --git a/crypto/initthread.c b/crypto/initthread.c
index a5f770e200..d6f7869b1b 100644
--- a/crypto/initthread.c
+++ b/crypto/initthread.c
@@ -297,7 +297,7 @@ void ossl_ctx_thread_stop(void *arg)
 
 static void init_thread_stop(void *arg, THREAD_EVENT_HANDLER **hands)
 {
-    THREAD_EVENT_HANDLER *curr, *prev = NULL;
+    THREAD_EVENT_HANDLER *curr, *prev = NULL, *tmp;
 
     /* Can't do much about this */
     if (hands == NULL)
@@ -306,15 +306,20 @@ static void init_thread_stop(void *arg, THREAD_EVENT_HANDLER **hands)
     curr = *hands;
     while (curr != NULL) {
         if (arg != NULL && curr->arg != arg) {
+            prev = curr;
             curr = curr->next;
             continue;
         }
         curr->handfn(curr->arg);
-        prev = curr;
+        if (prev == NULL)
+            *hands = curr->next;
+        else
+            prev->next = curr->next;
+
+        tmp = curr;
         curr = curr->next;
-        if (prev == *hands)
-            *hands = curr;
-        OPENSSL_free(prev);
+
+        OPENSSL_free(tmp);
     }
 }