Wayland: touch events, use of memory after it is freed

src/video/wayland/SDL_waylandevents.c

@@ -151,12 +151,16 @@ touch_del(SDL_TouchID id, float* x, float* y, struct wl_surface **surface)
                 touch_points.tail = tp->prev;
             }
 
+            {
+                struct SDL_WaylandTouchPoint *next = tp->next;
                 SDL_free(tp);
+                tp = next;
             }
-
+        } else {
             tp = tp->next;
         }
     }
+}
 
 static struct wl_surface*
 touch_surface(SDL_TouchID id)