--- a/jobs.c	Sat Feb 09 11:56:40 2008 +0100
+++ b/jobs.c	Sun Feb 10 21:42:06 2008 +0100
@@ -683,7 +683,7 @@
     struct Notify *n;
     struct Notify *new;
 
-    new = (struct Notify *) malloc(sizeof(*n));
+    new = (struct Notify *) malloc(sizeof(*new));
 
     new->socket = s;
     new->jobid = jobid;
@@ -763,22 +763,27 @@
     struct Job *j;
 
     n = first_notify;
-    while (n != 0 && n->jobid != jobid)
-    {
-        n = n->next;
-    }
-
-    if (n == 0)
+    while (n != 0)
     {
-        return;
-    }
-
-    j = get_job(jobid);
-    /* If the job finishes, notify the waiter */
-    if (j->state == FINISHED || j->state == SKIPPED)
-    {
-        send_waitjob_ok(n->socket, j->result.errorlevel);
-        s_remove_notification(n->socket);
+        if (n->jobid == jobid)
+        {
+            j = get_job(jobid);
+            /* If the job finishes, notify the waiter */
+            if (j->state == FINISHED || j->state == SKIPPED)
+            {
+                struct Notify *tmp;
+                send_waitjob_ok(n->socket, j->result.errorlevel);
+                /* We want to get the next Nofity* before we remove
+                 * the actual 'n'. As s_remove_notification() simply
+                 * removes the element from the linked list, we can
+                 * safely follow on the list from n->next. */
+                tmp = n;
+                n = n->next;
+                s_remove_notification(tmp->socket);
+            }
+        }
+        else
+            n = n->next;
     }
 }