A buggy C code snippet

update_auth_users.c

bool update_auth_users(
    auth_users_t *db,
    uint32_t group,
    uint32_t user_token,
    bool is_removal,
    uint32_t *ret
) {
    uint32_t count = 0;
    uint32_t index = 0;
    uint32_t *p = NULL;

    if (!is_removal) {
        while (index < db->user_count) {
            if (db->tokens[index].group == group) {
                p = (uint32_t *) &db->tokens[index].userlist[0];
                if (db->tokens[index].no_of_users == MAX_USER_LIMIT) {
                    LOG("Too many users");
                    *ret = RET_ERR_TOO_MANY;
                     return false;
                }
                while (count < db->tokens[index].no_of_users) {
                     if (p[count] == user) {
                        *ret = RET_OK;
                        return false;
                    }
                    count++;
                    p++;
                }
                *p = user;
                db->tokens[index].no_of_users++;
                *ret = RET_OK;
                return true;
            }
            index++;
        }
    } else {
        while (index < db->user_count) {
            if (db->tokens[index].group == group) {
                p = (uint32_t *) &db->tokens[index].userlist[0];
                while (count < db->tokens[index].no_of_users) {
                if (p[count] == user) {
                    if (count != (db->tokens[index].no_of_users - 1))
                        memcpy(&p[count+1], &p[count], db->tokens[index].no_of_users-1);
                        db->tokens[index].no_of_users--;
                        ret = RET_OK;
                        return true;
                    }
                    count++;
                    p++;
                }
                LOG("User %d does not exist", user);
                *ret = RET_BAD_INPUT;
                return false;
            }
            index++;
        }
    }
    *ret = RET_ERR_OTHER;
    return false;
}