Trigger & fix first fuzzing bug

fuzzing/TopicTree.cpp

@@ -7,6 +7,8 @@
 
 #include <memory>
 
+// std::vector<std::string_view> topics = {"", "one", "two", "three"};
+
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     /* Create topic tree */
     uWS::TopicTree<std::string> topicTree([](uWS::Subscriber *s, std::string &message, auto flags) {
@@ -75,6 +77,13 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
                 if (it != subscribers.end()) {
                     topicTree.unsubscribe(it->second, lastString);
                 }
+            } else if (data[4] == 'F') {
+                /* Free subscriber */
+                auto it = subscribers.find(id);
+                if (it != subscribers.end()) {
+                    topicTree.freeSubscriber(it->second);
+                    subscribers.erase(it);
+                }
             } else if (data[4] == 'A') {
                 /* Unsubscribe from all */
                 auto it = subscribers.find(id);

src/TopicTree.h

@@ -220,6 +220,20 @@ public:
             }
         }
 
+        /* We also need to unlink us */
+        if (s->needsDrainage()) {
+            if (s->prev) {
+                s->prev->next = s->next;
+            }
+            if (s->next) {
+                s->next->prev = s->prev;
+            }
+            /* If we are the head, then we also need to reset the head */
+            if (drainableSubscribers == s) {
+                drainableSubscribers = nullptr;
+            }
+        }
+
         delete s;
     }