From 2d67e48d0cdb7493757e4b24eb5b2cfe5e42f472 Mon Sep 17 00:00:00 2001
From: djm <djm>
Date: Fri, 26 Oct 2007 06:42:18 +0000
Subject: [PATCH]    - otto@cvs.openbsd.org 2005/10/17 20:19:42     
 [openbsd-compat/sys-queue.h]      Performing certain operations on queue.h
 data structurs produced      funny results.  An example is calling 
 LIST_REMOVE on the same      element twice. This will not fail, but result in
 a data structure      referencing who knows what. Prevent these accidents by
 NULLing some      fields on remove and replace. This way, either a panic or
 segfault      will be produced on the faulty operation.

---
 ChangeLog                  |  8 ++++++++
 openbsd-compat/sys-queue.h | 15 ++++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 4959750d..3de06a4f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -102,6 +102,14 @@
    - deraadt@cvs.openbsd.org 2005/02/25 13:29:30
      [openbsd-compat/sys-queue.h]
      minor white spacing
+   - otto@cvs.openbsd.org 2005/10/17 20:19:42
+     [openbsd-compat/sys-queue.h]
+     Performing certain operations on queue.h data structurs produced
+     funny results.  An example is calling  LIST_REMOVE on the same
+     element twice. This will not fail, but result in a data structure
+     referencing who knows what. Prevent these accidents by NULLing some
+     fields on remove and replace. This way, either a panic or segfault
+     will be produced on the faulty operation.
  - (djm) [regress/sftp-cmds.sh]
    Use more restrictive glob to pick up test files from /bin - some platforms
    ship broken symlinks there which could spoil the test.
diff --git a/openbsd-compat/sys-queue.h b/openbsd-compat/sys-queue.h
index 61e4ca7b..ee2ce30b 100644
--- a/openbsd-compat/sys-queue.h
+++ b/openbsd-compat/sys-queue.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: queue.h,v 1.27 2005/02/25 13:29:30 deraadt Exp $	*/
+/*	$OpenBSD: queue.h,v 1.28 2005/10/17 20:19:42 otto Exp $	*/
 /*	$NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $	*/
 
 /*
@@ -236,6 +236,7 @@ struct {								\
 			curelm = curelm->field.sle_next;		\
 		curelm->field.sle_next =				\
 		    curelm->field.sle_next->field.sle_next;		\
+		(elm)->field.sle_next = NULL;				\
 	}								\
 } while (0)
 
@@ -303,6 +304,8 @@ struct {								\
 		(elm)->field.le_next->field.le_prev =			\
 		    (elm)->field.le_prev;				\
 	*(elm)->field.le_prev = (elm)->field.le_next;			\
+	(elm)->field.le_prev = NULL; 					\
+	(elm)->field.le_next = NULL;					\
 } while (0)
 
 #define LIST_REPLACE(elm, elm2, field) do {				\
@@ -311,6 +314,8 @@ struct {								\
 		    &(elm2)->field.le_next;				\
 	(elm2)->field.le_prev = (elm)->field.le_prev;			\
 	*(elm2)->field.le_prev = (elm2);				\
+	(elm)->field.le_prev = NULL; 					\
+	(elm)->field.le_next = NULL;					\
 } while (0)
 
 /*
@@ -465,6 +470,8 @@ struct {								\
 	else								\
 		(head)->tqh_last = (elm)->field.tqe_prev;		\
 	*(elm)->field.tqe_prev = (elm)->field.tqe_next;			\
+	(elm)->field.tqe_prev = NULL; 					\
+	(elm)->field.tqe_next = NULL;					\
 } while (0)
 
 #define TAILQ_REPLACE(head, elm, elm2, field) do {			\
@@ -475,6 +482,8 @@ struct {								\
 		(head)->tqh_last = &(elm2)->field.tqe_next;		\
 	(elm2)->field.tqe_prev = (elm)->field.tqe_prev;			\
 	*(elm2)->field.tqe_prev = (elm2);				\
+	(elm)->field.tqe_prev = NULL; 					\
+	(elm)->field.tqe_next = NULL;					\
 } while (0)
 
 /*
@@ -575,6 +584,8 @@ struct {								\
 	else								\
 		(elm)->field.cqe_prev->field.cqe_next =			\
 		    (elm)->field.cqe_next;				\
+	(elm)->field.cqe_next = NULL;					\
+	(elm)->field.cqe_prev = NULL;					\
 } while (0)
 
 #define CIRCLEQ_REPLACE(head, elm, elm2, field) do {			\
@@ -588,6 +599,8 @@ struct {								\
 		(head).cqh_first = (elm2);				\
 	else								\
 		(elm2)->field.cqe_prev->field.cqe_next = (elm2);	\
+	(elm)->field.cqe_next = NULL;					\
+	(elm)->field.cqe_prev = NULL;					\
 } while (0)
 
 #endif	/* !_FAKE_QUEUE_H_ */
-- 
2.45.2