From bdc4761c4698defa2f3f650b48af542042c78805 Mon Sep 17 00:00:00 2001
From: bol-van <none@none.none>
Date: Sun, 12 Apr 2026 20:50:27 +0300
Subject: [PATCH] nfqws2: fix read after free

---
 nfq2/timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nfq2/timer.c b/nfq2/timer.c
index 405a96f..36a42e8 100644
--- a/nfq2/timer.c
+++ b/nfq2/timer.c
@@ -96,13 +96,13 @@ void TimerPoolRun(timer_pool **pp, uint64_t bt)
 			del = NULL;
 			if (!TimerPoolRunTimer(elem))
 				del = "timer: '%s' deleted because of error\n";
-			else if (elem->oneshot)
-				del = "timer: '%s' deleted because of oneshot\n";
 
 			// timer function could delete the timer or recreate with the same name
 			p = TimerPoolSearch(*pp, name);
 			if (p==elem && p->n==n)
 			{
+				if (!del && elem->oneshot)
+					del = "timer: '%s' deleted because of oneshot\n";
 				// elem is valid, not deleted and not recreated
 				if (del)
 				{