From dd67cb01f2249595fe6ae1ff24bd193e4f3e72b3 Mon Sep 17 00:00:00 2001
From: Alex Hultman <alexhultman@gmail.com>
Date: Sat, 25 Sep 2021 06:26:58 +0200
Subject: [PATCH] Trigger & fix first fuzzing bug

---
 fuzzing/TopicTree.cpp |  9 +++++++++
 src/TopicTree.h       | 14 ++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/fuzzing/TopicTree.cpp b/fuzzing/TopicTree.cpp
index 2fc770c..d344fff 100644
--- a/fuzzing/TopicTree.cpp
+++ b/fuzzing/TopicTree.cpp
@@ -7,6 +7,8 @@
 
 #include <memory>
 
+// std::vector<std::string_view> topics = {"", "one", "two", "three"};
+
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     /* Create topic tree */
     uWS::TopicTree<std::string> topicTree([](uWS::Subscriber *s, std::string &message, auto flags) {
@@ -75,6 +77,13 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
                 if (it != subscribers.end()) {
                     topicTree.unsubscribe(it->second, lastString);
                 }
+            } else if (data[4] == 'F') {
+                /* Free subscriber */
+                auto it = subscribers.find(id);
+                if (it != subscribers.end()) {
+                    topicTree.freeSubscriber(it->second);
+                    subscribers.erase(it);
+                }
             } else if (data[4] == 'A') {
                 /* Unsubscribe from all */
                 auto it = subscribers.find(id);
diff --git a/src/TopicTree.h b/src/TopicTree.h
index ba6a263..bc484b8 100644
--- a/src/TopicTree.h
+++ b/src/TopicTree.h
@@ -220,6 +220,20 @@ public:
             }
         }
 
+        /* We also need to unlink us */
+        if (s->needsDrainage()) {
+            if (s->prev) {
+                s->prev->next = s->next;
+            }
+            if (s->next) {
+                s->next->prev = s->prev;
+            }
+            /* If we are the head, then we also need to reset the head */
+            if (drainableSubscribers == s) {
+                drainableSubscribers = nullptr;
+            }
+        }
+
         delete s;
     }