capmt: fix invalid use of free()'d data as spotted by EricV

diff --git a/src/descrambler/capmt.c b/src/descrambler/capmt.c
index cf64e46d1af499d54f5c0d769d1bef9b56cfb336..779981a4d018a54aa0d8844b751bd62cefa93b4b 100644 (file)
--- a/src/descrambler/capmt.c
+++ b/src/descrambler/capmt.c
@@ -411,11 +411,11 @@ capmt_service_destroy(th_descrambler_t *td)
 
   LIST_REMOVE(ct, ct_link);
 
-  tvhcsa_destroy(&ct->ct_csa);
-  free(ct);
-
   if (ct->ct_capmt->capmt_oscam == 2)
     capmt_enumerate_services(ct->ct_capmt, 0, 1);
+
+  tvhcsa_destroy(&ct->ct_csa);
+  free(ct);
 }
 
 static void