coverity: Fix some (harmless?) use-after-free with g_slist_remove()

These were passing a pointer to a variable right after it was g_free()'d

They are most likely harmless as g_slist_remove() probably just needs
the pointer location, but fixing it anyway.

3 files changed, 4 insertions, 6 deletions

diff --git a/protocols/msn/msn.c b/protocols/msn/msn.c
index 6ab35696..cb3f842c 100644
--- a/protocols/msn/msn.c
+++ b/protocols/msn/msn.c
@@ -111,10 +111,10 @@ static void msn_logout(struct im_connection *ic)
 
 		while (md->groups) {
 			struct msn_group *mg = md->groups->data;
+			md->groups = g_slist_remove(md->groups, mg);
 			g_free(mg->id);
 			g_free(mg->name);
 			g_free(mg);
-			md->groups = g_slist_remove(md->groups, mg);
 		}
 
 		g_free(md->profile_rid);
@@ -126,10 +126,10 @@ static void msn_logout(struct im_connection *ic)
 
 		while (md->grpq) {
 			struct msn_groupadd *ga = md->grpq->data;
+			md->grpq = g_slist_remove(md->grpq, ga);
 			g_free(ga->group);
 			g_free(ga->who);
 			g_free(ga);
-			md->grpq = g_slist_remove(md->grpq, ga);
 		}
 
 		g_free(md);
diff --git a/protocols/msn/ns.c b/protocols/msn/ns.c
index f6c553a8..02abc52c 100644
--- a/protocols/msn/ns.c
+++ b/protocols/msn/ns.c
@@ -943,10 +943,9 @@ void msn_ns_oim_send_queue(struct im_connection *ic, GSList **msgq)
 	while (*msgq != NULL) {
 		struct msn_message *m = (*msgq)->data;
 
+		*msgq = g_slist_remove(*msgq, m);
 		g_free(m->who);
 		g_free(m->text);
 		g_free(m);
-
-		*msgq = g_slist_remove(*msgq, m);
 	}
 }
diff --git a/protocols/msn/sb.c b/protocols/msn/sb.c
index d0412961..a9f3838f 100644
--- a/protocols/msn/sb.c
+++ b/protocols/msn/sb.c
@@ -518,11 +518,10 @@ static int msn_sb_command(struct msn_handler_data *handler, char **cmd, int num_
 						st = msn_sb_sendmessage(sb, m->text);
 					}
 				}
+				sb->msgq = g_slist_remove(sb->msgq, m);
 				g_free(m->text);
 				g_free(m->who);
 				g_free(m);
-
-				sb->msgq = g_slist_remove(sb->msgq, m);
 			}
 
 			msn_sb_start_keepalives(sb, FALSE);