Wayland: touch events, use of memory after it is freed

1 files changed, 7 insertions, 3 deletions

diff --git a/src/video/wayland/SDL_waylandevents.c b/src/video/wayland/SDL_waylandevents.c
index 2f842e1948..013ac660b3 100644
--- a/src/video/wayland/SDL_waylandevents.c
+++ b/src/video/wayland/SDL_waylandevents.c
@@ -151,10 +151,14 @@ touch_del(SDL_TouchID id, float* x, float* y, struct wl_surface **surface)
                 touch_points.tail = tp->prev;
             }
 
-            SDL_free(tp);
+            {
+                struct SDL_WaylandTouchPoint *next = tp->next;
+                SDL_free(tp);
+                tp = next;
+            }
+        } else {
+            tp = tp->next;
         }
-
-        tp = tp->next;
     }
 }