


Q: Given the following code slice:
```
1 static int cancel_channel_subscription(struct nerd_channel *chan, int sd)
3     objectlist *list, *next, *prev = NULL;
4     int cancelled = 0;
5     if (!chan)
7         return -1;
9     for (list = chan->subscriptions; list; list = next)
11         struct subscription *subscr = (subscription *)list->object_ptr;
12         next = list->next;
13         if (subscr->sd == sd)
15             cancelled++;
16             free(list);
17             if (prev)
19                 prev->next = next;
23                 chan->subscriptions = next;
25             continue;
27         prev = list;
29     if (cancelled)
31         logit(NSLOG_INFO_MESSAGE, TRUE, "nerd: Cancelled %d subscription%s to channel '%s' for %d\n", cancelled, cancelled == 1 ? "" : "s", chan->name, sd);
33     if (chan->subscriptions == NULL)
35         nerd_deregister_channel_callbacks(chan);
37     return 0;```
which has a CWE-457 vulnerability at line:
```
26         }
```
Please generate the patch for the vulnerability. Please follow the patch format in the exemplars.
The patching can be done in two steps.

Step 1. Root Cause Analysis: Looking at the given vulnerable code line and its context, the CWE-401 (Memory Leak) vulnerability exists in the code because the `subscription` object `subscr` is not freed when a subscription is cancelled. This causes a memory leak.

Step 2. Fixing Strategy. A common fixing strategy is to free the `subscription` object `subscr` when a subscription is cancelled. This can be done by adding a `free(subscr)` statement before freeing the `list` object. Therefore the patch should be:
```
<             free(list);
<             if (prev)
---
>             free(list);
>             free(subscr);
>             if (prev)
```
This patch ensures that the `subscription` object `subscr` is properly freed when a subscription is cancelled, preventing a memory leak.