When tdelete() is used to delete the root node, don't return a

pointer to the freed root node, but return a pointer to the new
root node. POSIX does not define, what should be returned in
that case.

Fixes Coverity CID 2528.

ok millert@ otto@

2 files changed, 5 insertions, 3 deletions

diff --git a/lib/libc/stdlib/tsearch.3 b/lib/libc/stdlib/tsearch.3
index 589f0574a88..ebc521ba17f 100644
--- a/lib/libc/stdlib/tsearch.3
+++ b/lib/libc/stdlib/tsearch.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: tsearch.3,v 1.13 2006/01/30 19:50:41 jmc Exp $
+.\" $OpenBSD: tsearch.3,v 1.14 2006/04/04 11:21:50 moritz Exp $
 .\"
 .\" Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
 .\"
@@ -74,7 +74,7 @@ and
 .Fn tsearch .
 If the node to be deleted is the root of the binary search tree,
 .Fa rootp
-will be adjusted.
+will be adjusted and a pointer to the new root will be returned.
 .Pp
 .Fn twalk
 walks the binary search tree rooted in
diff --git a/lib/libc/stdlib/tsearch.c b/lib/libc/stdlib/tsearch.c
index a5d0c2b9b3d..667c57731bb 100644
--- a/lib/libc/stdlib/tsearch.c
+++ b/lib/libc/stdlib/tsearch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tsearch.c,v 1.5 2005/03/30 18:51:49 pat Exp $	*/
+/*	$OpenBSD: tsearch.c,v 1.6 2006/04/04 11:21:50 moritz Exp $	*/
 
 /*
  * Tree search generalized from Knuth (6.2.2) Algorithm T just like
@@ -86,6 +86,8 @@ tdelete(const void *vkey, void **vrootp,
 	    q->right = (*rootp)->right;
 	}
     }
+    if (p == *rootp)
+        p = q;
     free((struct node_t *) *rootp);	/* D4: Free node */
     *rootp = q;				/* link parent to new node */
     return(p);