coverity: Fix some (harmless?) use-after-free with g_slist_remove()

These were passing a pointer to a variable right after it was g_free()'d

They are most likely harmless as g_slist_remove() probably just needs
the pointer location, but fixing it anyway.

7 files changed, 10 insertions, 12 deletions

diff --git a/ipc.c b/ipc.c
index b7ab9552..4041f442 100644
--- a/ipc.c
+++ b/ipc.c
@@ -775,14 +775,14 @@ void ipc_master_free_one(struct bitlbee_child *c)
 		close(c->to_fd);
 	}
 
+	child_list = g_slist_remove(child_list, c);
+
 	g_free(c->host);
 	g_free(c->nick);
 	g_free(c->realname);
 	g_free(c->password);
 	g_free(c);
 
-	child_list = g_slist_remove(child_list, c);
-
 	/* Also, if any child has a reference to this one, remove it. */
 	for (l = child_list; l; l = l->next) {
 		struct bitlbee_child *oc = l->data;
diff --git a/lib/oauth.c b/lib/oauth.c
index f15a7135..ac5bc654 100644
--- a/lib/oauth.c
+++ b/lib/oauth.c
@@ -106,8 +106,8 @@ void oauth_params_del(GSList **params, const char *key)
 
 		if (strncmp((char *) l->data, key, key_len) == 0 &&
 		    ((char *) l->data)[key_len] == '=') {
-			g_free(l->data);
 			*params = g_slist_remove(*params, l->data);
+			g_free(l->data);
 		}
 	}
 }
diff --git a/protocols/bee_user.c b/protocols/bee_user.c
index ea1be3db..0a211c71 100644
--- a/protocols/bee_user.c
+++ b/protocols/bee_user.c
@@ -67,6 +67,8 @@ int bee_user_free(bee_t *bee, bee_user_t *bu)
 		bu->ic->acc->prpl->buddy_data_free(bu);
 	}
 
+	bee->users = g_slist_remove(bee->users, bu);
+
 	g_free(bu->handle);
 	g_free(bu->fullname);
 	g_free(bu->nick);
@@ -74,8 +76,6 @@ int bee_user_free(bee_t *bee, bee_user_t *bu)
 	g_free(bu->status_msg);
 	g_free(bu);
 
-	bee->users = g_slist_remove(bee->users, bu);
-
 	return 1;
 }
 
diff --git a/protocols/msn/msn.c b/protocols/msn/msn.c
index 6ab35696..cb3f842c 100644
--- a/protocols/msn/msn.c
+++ b/protocols/msn/msn.c
@@ -111,10 +111,10 @@ static void msn_logout(struct im_connection *ic)
 
 		while (md->groups) {
 			struct msn_group *mg = md->groups->data;
+			md->groups = g_slist_remove(md->groups, mg);
 			g_free(mg->id);
 			g_free(mg->name);
 			g_free(mg);
-			md->groups = g_slist_remove(md->groups, mg);
 		}
 
 		g_free(md->profile_rid);
@@ -126,10 +126,10 @@ static void msn_logout(struct im_connection *ic)
 
 		while (md->grpq) {
 			struct msn_groupadd *ga = md->grpq->data;
+			md->grpq = g_slist_remove(md->grpq, ga);
 			g_free(ga->group);
 			g_free(ga->who);
 			g_free(ga);
-			md->grpq = g_slist_remove(md->grpq, ga);
 		}
 
 		g_free(md);
diff --git a/protocols/msn/ns.c b/protocols/msn/ns.c
index f6c553a8..02abc52c 100644
--- a/protocols/msn/ns.c
+++ b/protocols/msn/ns.c
@@ -943,10 +943,9 @@ void msn_ns_oim_send_queue(struct im_connection *ic, GSList **msgq)
 	while (*msgq != NULL) {
 		struct msn_message *m = (*msgq)->data;
 
+		*msgq = g_slist_remove(*msgq, m);
 		g_free(m->who);
 		g_free(m->text);
 		g_free(m);
-
-		*msgq = g_slist_remove(*msgq, m);
 	}
 }
diff --git a/protocols/msn/sb.c b/protocols/msn/sb.c
index d0412961..a9f3838f 100644
--- a/protocols/msn/sb.c
+++ b/protocols/msn/sb.c
@@ -518,11 +518,10 @@ static int msn_sb_command(struct msn_handler_data *handler, char **cmd, int num_
 						st = msn_sb_sendmessage(sb, m->text);
 					}
 				}
+				sb->msgq = g_slist_remove(sb->msgq, m);
 				g_free(m->text);
 				g_free(m->who);
 				g_free(m);
-
-				sb->msgq = g_slist_remove(sb->msgq, m);
 			}
 
 			msn_sb_start_keepalives(sb, FALSE);
diff --git a/protocols/yahoo/yahoo.c b/protocols/yahoo/yahoo.c
index 8048ef8f..728803fb 100644
--- a/protocols/yahoo/yahoo.c
+++ b/protocols/yahoo/yahoo.c
@@ -732,9 +732,9 @@ void ext_yahoo_remove_handler(int id, int tag)
 	while (l) {
 		inp = l->data;
 		if (inp->h == tag) {
+			byahoo_inputs = g_slist_remove(byahoo_inputs, inp);
 			g_free(inp->d);
 			g_free(inp);
-			byahoo_inputs = g_slist_remove(byahoo_inputs, inp);
 			break;
 		}
 		l = l->next;