Fix dlist entry mangling

diff --git a/src/main/state.c b/src/main/state.c
index 9b2d175d02b3a0753afb09c4f61cec29dfbfee90..7344e7ad5ea5a1f100ab38ea5039cf16cde6d6e3 100644 (file)
--- a/src/main/state.c
+++ b/src/main/state.c
@@ -311,11 +311,12 @@ static fr_state_entry_t *state_entry_create(fr_state_tree_t *state, REQUEST *req
        /*
         *      Clean up old entries.
         */
-       for (next = FR_DLIST_FIRST(state->to_expire);
-            next;
-            next = FR_DLIST_NEXT(state->to_expire, next)) {
+       next = FR_DLIST_FIRST(state->to_expire);
+       while (next) {
                entry = fr_ptr_to_type(fr_state_entry_t, list, next);
                (void)talloc_get_type_abort(entry, fr_state_entry_t);   /* Allow examination */
+               next = FR_DLIST_NEXT(state->to_expire, next);           /* Advance *before* potential unlinking */
+
                if (entry == old) continue;
 
                /*