Fix broken list-munging in ecpg's remove_variables().

The loops over cursor argument variables neglected to ever advance
"prevvar".  The code would accidentally do the right thing anyway
when removing the first or second list entry, but if it had to
remove the third or later entry then it would also remove all
entries between there and the first entry.  AFAICS this would
only matter for cursors that reference out-of-scope variables,
which is a weird Informix compatibility hack; between that and
the lack of impact for short lists, it's not so surprising that
nobody has complained.  Nonetheless it's a pretty obvious bug.

It would have been more obvious if these loops used a more standard
coding style for chasing the linked lists --- this business with the
"prev" pointer sometimes pointing at the current list entry is
confusing and overcomplicated.  So rather than just add a minimal
band-aid, I chose to rewrite the loops in the same style we use
elsewhere, where the "prev" pointer is NULL until we are dealing with
a non-first entry and we save the "next" pointer at the top of the
loop.  (Two of the four loops touched here are not actually buggy,
but it seems better to make them all look alike.)

Coverity discovered this problem, but not until 2b41de4a5 added code
to free no-longer-needed arguments structs.  With that, the incorrect
link updates are possibly touching freed memory, and it complained
about that.  Nonetheless the list corruption hazard is ancient, so
back- to all supported branches.

diff --git a/src/interfaces/ecpg/preproc/variable.c b/src/interfaces/ecpg/preproc/variable.c
index ec5afde7d69a6fa5d6d2f283ee918a1b12bdae3e..f2e6218d7619a5f074446334dcb3119b7722c535 100644 (file)
--- a/src/interfaces/ecpg/preproc/variable.c
+++ b/src/interfaces/ecpg/preproc/variable.c
@@ -264,17 +264,19 @@ void
 remove_typedefs(int brace_level)
 {
    struct typedefs *p,
-              *prev;
+              *prev,
+              *next;
 
-   for (p = prev = types; p;)
+   for (p = types, prev = NULL; p; p = next)
    {
+       next = p->next;
        if (p->brace_level >= brace_level)
        {
            /* remove it */
-           if (p == types)
-               prev = types = p->next;
+           if (prev)
+               prev->next = next;
            else
-               prev->next = p->next;
+               types = next;
 
            if (p->type->type_enum == ECPGt_struct || p->type->type_enum == ECPGt_union)
                ECPGfree_struct_member(p->struct_member_list);
@@ -286,16 +288,9 @@ remove_typedefs(int brace_level)
            free(p->type);
            free(p->name);
            free(p);
-           if (prev == types)
-               p = types;
-           else
-               p = prev ? prev->next : NULL;
        }
        else
-       {
            prev = p;
-           p = prev->next;
-       }
    }
 }
 
@@ -303,13 +298,15 @@ void
 remove_variables(int brace_level)
 {
    struct variable *p,
-              *prev;
+              *prev,
+              *next;
 
-   for (p = prev = allvariables; p;)
+   for (p = allvariables, prev = NULL; p; p = next)
    {
+       next = p->next;
        if (p->brace_level >= brace_level)
        {
-           /* is it still referenced by a cursor? */
+           /* remove it, but first remove any references from cursors */
            struct cursor *ptr;
 
            for (ptr = cur; ptr != NULL; ptr = ptr->next)
@@ -318,53 +315,52 @@ remove_variables(int brace_level)
                           *prevvar,
                           *nextvar;
 
-               for (varptr = prevvar = ptr->argsinsert; varptr != NULL; varptr = nextvar)
+               for (varptr = ptr->argsinsert, prevvar = NULL;
+                    varptr != NULL; varptr = nextvar)
                {
                    nextvar = varptr->next;
                    if (p == varptr->variable)
                    {
                        /* remove from list */
-                       if (varptr == ptr->argsinsert)
-                           ptr->argsinsert = varptr->next;
+                       if (prevvar)
+                           prevvar->next = nextvar;
                        else
-                           prevvar->next = varptr->next;
+                           ptr->argsinsert = nextvar;
                        free(varptr);
                    }
+                   else
+                       prevvar = varptr;
                }
-               for (varptr = prevvar = ptr->argsresult; varptr != NULL; varptr = nextvar)
+               for (varptr = ptr->argsresult, prevvar = NULL;
+                    varptr != NULL; varptr = nextvar)
                {
                    nextvar = varptr->next;
                    if (p == varptr->variable)
                    {
                        /* remove from list */
-                       if (varptr == ptr->argsresult)
-                           ptr->argsresult = varptr->next;
+                       if (prevvar)
+                           prevvar->next = nextvar;
                        else
-                           prevvar->next = varptr->next;
+                           ptr->argsresult = nextvar;
                        free(varptr);
                    }
+                   else
+                       prevvar = varptr;
                }
            }
 
            /* remove it */
-           if (p == allvariables)
-               prev = allvariables = p->next;
+           if (prev)
+               prev->next = next;
            else
-               prev->next = p->next;
+               allvariables = next;
 
            ECPGfree_type(p->type);
            free(p->name);
            free(p);
-           if (prev == allvariables)
-               p = allvariables;
-           else
-               p = prev ? prev->next : NULL;
        }
        else
-       {
            prev = p;
-           p = prev->next;
-       }
    }
 }