transaction: Fix potenial use after free of members

Change-Id: I177959fb298ae04c4e8df877582fc9a1bd4dc2cf
---
M src/libmsc/transaction.c
1 file changed, 6 insertions(+), 2 deletions(-)


git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/53/40853/1

diff --git a/src/libmsc/transaction.c b/src/libmsc/transaction.c
index 19ffcb9..92af621 100644
--- a/src/libmsc/transaction.c
+++ b/src/libmsc/transaction.c
@@ -239,6 +239,8 @@
 {
 	const char *usage_token;
 	struct msc_a *msc_a;
+	struct paging_request *pr;
+	struct vlr_subscr *vsub;
 
 	LOG_TRANS(trans, LOGL_DEBUG, "Freeing transaction\n");
 
@@ -273,13 +275,15 @@
 	}
 
 	if (trans->paging_request) {
-		paging_request_remove(trans->paging_request);
+		pr = trans->paging_request;
 		trans->paging_request = NULL;
+		paging_request_remove(pr);
 	}
 
 	if (trans->vsub) {
-		vlr_subscr_put(trans->vsub, trans_vsub_use(trans->type));
+		vsub = trans->vsub;
 		trans->vsub = NULL;
+		vlr_subscr_put(vsub, trans_vsub_use(trans->type));
 	}
 
 	msc_a = trans->msc_a;

