# HG changeset patch
# User Elliott Sales de Andrade <qulogic@pidgin.im>
# Date 1275173534 0
# Node ID d60313011111b35b486019c2282b9cf39e453c64
# Parent  74776878c0555907d4c8073529286924e7d9983f
Fix a read-after-free from valgrind:

Invalid read of size 8
   at 0x9BD2816: purple_upnp_cancel_port_mapping (upnp.c:931)
   by 0x9BAEF41: purple_network_listen_cancel (network.c:585)
   by 0x1A49D7FD: msn_dc_destroy (directconn.c:204)
 Address 0x19c3c748 is 8 bytes inside a block of size 16 free'd
   at 0x4C239BF: free (vg_replace_malloc.c:325)
   by 0xBC1EB97: g_slist_delete_link (gslist.c:446)
   by 0x9BD2815: purple_upnp_cancel_port_mapping (upnp.c:928)
   by 0x9BAEF41: purple_network_listen_cancel (network.c:585)
   by 0x1A49D7FD: msn_dc_destroy (directconn.c:204)

diff -r 74776878c055 -r d60313011111 libpurple/upnp.c
--- a/libpurple/upnp.c	Sat May 29 22:27:26 2010 +0000
+++ b/libpurple/upnp.c	Sat May 29 22:52:14 2010 +0000
@@ -921,15 +921,18 @@
 	/* Remove ar from discovery_callbacks if present; it was inserted after a cb.
 	 * The same cb may be in the list multiple times, so be careful to remove
 	 * the one associated with ar. */
-	l  = discovery_callbacks;
+	l = discovery_callbacks;
 	while (l)
 	{
-		if (l->next && (l->next->data == ar)) {
-			discovery_callbacks = g_slist_delete_link(discovery_callbacks, l->next);
+		GSList *next = l->next;
+
+		if (next && (next->data == ar)) {
+			discovery_callbacks = g_slist_delete_link(discovery_callbacks, next);
+			next = l->next;
 			discovery_callbacks = g_slist_delete_link(discovery_callbacks, l);
 		}
 
-		l = l->next;
+		l = next;
 	}
 
 	if (ar->tima > 0)