From d21786473732952ece81adc20136f616aac77019 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 23 Jun 2010 09:49:04 +0200
Subject: [PATCH] fix use-after-free in spice_marshaller_reset

---
 common/marshaller.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/common/marshaller.c b/common/marshaller.c
index 5844b89..ece4f48 100644
--- a/common/marshaller.c
+++ b/common/marshaller.c
@@ -157,13 +157,14 @@ static void free_items(SpiceMarshaller *m)
 
 void spice_marshaller_reset(SpiceMarshaller *m)
 {
-    SpiceMarshaller *m2;
+    SpiceMarshaller *m2, *next;
     SpiceMarshallerData *d;
 
     /* Only supported for root marshaller */
     assert(m->data->marshallers == m);
 
-    for (m2 = m; m2 != NULL; m2 = m2->next) {
+    for (m2 = m; m2 != NULL; m2 = next) {
+        next = m2->next;
         free_item_data(m2);
 
         /* Free non-root marshallers */