From 39823fee142013f20b5db60ea4b555098f93c978 Mon Sep 17 00:00:00 2001
From: Mika Liljeberg <mika.liljeberg@nokia.com>
Date: Wed, 10 Nov 2010 14:22:28 +0200
Subject: [PATCH] gisi: fix crash bug in g_isi_remove_subscription

---
 gisi/client.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/gisi/client.c b/gisi/client.c
index 8ab3dc9f..8e413314 100644
--- a/gisi/client.c
+++ b/gisi/client.c
@@ -744,16 +744,19 @@ int g_isi_subscribe(GIsiClient *client, uint8_t type,
  */
 void g_isi_remove_subscription(GIsiClient *client, uint8_t res, uint8_t type)
 {
+	void *ret;
 	GIsiIndication *ind;
 	unsigned int id = (res << 8) | type;
 
 	if (!client)
 		return;
 
-	ind = tdelete(&id, &client->inds.subs, g_isi_cmp);
-	if (!ind)
+	ret = tfind(&id, &client->inds.subs, g_isi_cmp);
+	if (!ret)
 		return;
 
+	ind = *(GIsiIndication **)ret;
+	tdelete(ind, &client->inds.subs, g_isi_cmp);
 	client->inds.count--;
 	g_free(ind);
 }