Fix rare segfault on package removal

Very rarely a segfault would occur when removing a number of packages
due to a corrupted list for the local database (FS#27805, FS#28195).
This was caused by the alpm_list_msort function not correctly dealing
with the two new head node's prev values.

Signed-off-by: Allan McRae <allan@archlinux.org>
Signed-off-by: Dan McGee <dan@archlinux.org>

1 files changed, 4 insertions, 1 deletions

diff --git a/lib/libalpm/alpm_list.c b/lib/libalpm/alpm_list.c
index 15286aa1..3aa4f9bc 100644
--- a/lib/libalpm/alpm_list.c
+++ b/lib/libalpm/alpm_list.c
@@ -279,8 +279,11 @@ alpm_list_t SYMEXPORT *alpm_list_msort(alpm_list_t *list, size_t n, alpm_list_fn
 		alpm_list_t *left = list;
 		alpm_list_t *lastleft = alpm_list_nth(list, n/2 - 1);
 		alpm_list_t *right = lastleft->next;
-		/* terminate first list */
+
+		/* tidy new lists */
 		lastleft->next = NULL;
+		right->prev = left->prev;
+		left->prev = lastleft;
 
 		left = alpm_list_msort(left, n/2, fn);
 		right = alpm_list_msort(right, n - (n/2), fn);