diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 3c86eee6..f8dd4639 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -844,3 +844,7 @@ Markus Hardt <markus.hardt@gmx.net>
 
 Thomas Rausch <Thomas.Rausch@gmx.de>
  for making VDR try to get a timer's channel without RID when loading 'timers.conf'
+
+Thomas v. Keller <v.keller@neckarufer.de>
+ for reporting a crash in case the CAM connection fails while a CAM menu
+ is being presented
diff --git a/HISTORY b/HISTORY
index 14b3db40..62eb52dc 100644
--- a/HISTORY
+++ b/HISTORY
@@ -2444,3 +2444,8 @@ Video Disk Recorder Revision History
 - Continuing learning remote control keys in case one rc fails (thanks to
   Oliver Endriss).
 - Fixed handling comments in editing marks.
+
+2003-10-26: Version 1.2.6pre4
+
+- Fixed handling CAM menus in case the CAM connection fails while the menu
+  is being presented (thanks to Thomas v. Keller for reportign this one).
diff --git a/ci.c b/ci.c
index e94c20a0..1e839503 100644
--- a/ci.c
+++ b/ci.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: ci.c 1.16 2003/08/02 10:00:01 kls Exp $
+ * $Id: ci.c 1.16.1.1 2003/10/26 13:04:23 kls Exp $
  */
 
 /* XXX TODO
@@ -1004,15 +1004,15 @@ bool cCiDateTime::Process(int Length, const uint8_t *Data)
 class cCiMMI : public cCiSession {
 private:
   char *GetText(int &Length, const uint8_t **Data);
-  cCiMenu *menu;
-  cCiEnquiry *enquiry;
+  cCiMenu *menu, *fetchedMenu;
+  cCiEnquiry *enquiry, *fetchedEnquiry;
 public:
   cCiMMI(int SessionId, cCiTransportConnection *Tc);
   virtual ~cCiMMI();
   virtual bool Process(int Length = 0, const uint8_t *Data = NULL);
   virtual bool HasUserIO(void) { return menu || enquiry; }
-  cCiMenu *Menu(void);
-  cCiEnquiry *Enquiry(void);
+  cCiMenu *Menu(bool Clear = false);
+  cCiEnquiry *Enquiry(bool Clear = false);
   bool SendMenuAnswer(uint8_t Selection);
   bool SendAnswer(const char *Text);
   };
@@ -1021,13 +1021,21 @@ cCiMMI::cCiMMI(int SessionId, cCiTransportConnection *Tc)
 :cCiSession(SessionId, RI_MMI, Tc)
 {
   dbgprotocol("New MMI (session id %d)\n", SessionId);
-  menu = NULL;
-  enquiry = NULL;
+  menu = fetchedMenu = NULL;
+  enquiry = fetchedEnquiry = NULL;
 }
 
 cCiMMI::~cCiMMI()
 {
+  if (fetchedMenu) {
+     cMutexLock MutexLock(&fetchedMenu->mutex);
+     fetchedMenu->mmi = NULL;
+     }
   delete menu;
+  if (fetchedEnquiry) {
+     cMutexLock MutexLock(&fetchedEnquiry->mutex);
+     fetchedEnquiry->mmi = NULL;
+     }
   delete enquiry;
 }
 
@@ -1123,18 +1131,26 @@ bool cCiMMI::Process(int Length, const uint8_t *Data)
   return true;
 }
 
-cCiMenu *cCiMMI::Menu(void)
+cCiMenu *cCiMMI::Menu(bool Clear)
 {
-  cCiMenu *m = menu;
-  menu = NULL;
-  return m;
+  if (Clear)
+     fetchedMenu = NULL;
+  else if (menu) {
+     fetchedMenu = menu;
+     menu = NULL;
+     }
+  return fetchedMenu;
 }
 
-cCiEnquiry *cCiMMI::Enquiry(void)
+cCiEnquiry *cCiMMI::Enquiry(bool Clear)
 {
-  cCiEnquiry *e = enquiry;
-  enquiry = NULL;
-  return e;
+  if (Clear)
+     fetchedEnquiry = NULL;
+  else if (enquiry) {
+     fetchedEnquiry = enquiry;
+     enquiry = NULL;
+     }
+  return fetchedEnquiry;
 }
 
 bool cCiMMI::SendMenuAnswer(uint8_t Selection)
@@ -1170,6 +1186,9 @@ cCiMenu::cCiMenu(cCiMMI *MMI, bool Selectable)
 
 cCiMenu::~cCiMenu()
 {
+  cMutexLock MutexLock(&mutex);
+  if (mmi)
+     mmi->Menu(true);
   free(titleText);
   free(subTitleText);
   free(bottomText);
@@ -1188,6 +1207,7 @@ bool cCiMenu::AddEntry(char *s)
 
 bool cCiMenu::Select(int Index)
 {
+  cMutexLock MutexLock(&mutex);
   if (mmi && -1 <= Index && Index < numEntries)
      return mmi->SendMenuAnswer(Index + 1);
   return false;
@@ -1210,11 +1230,15 @@ cCiEnquiry::cCiEnquiry(cCiMMI *MMI)
 
 cCiEnquiry::~cCiEnquiry()
 {
+  cMutexLock MutexLock(&mutex);
+  if (mmi)
+     mmi->Enquiry(true);
   free(text);
 }
 
 bool cCiEnquiry::Reply(const char *s)
 {
+  cMutexLock MutexLock(&mutex);
   return mmi ? mmi->SendAnswer(s) : false;
 }
 
diff --git a/ci.h b/ci.h
index 62046e5a..a847cb13 100644
--- a/ci.h
+++ b/ci.h
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: ci.h 1.8 2003/05/25 11:44:47 kls Exp $
+ * $Id: ci.h 1.8.1.1 2003/10/26 12:22:09 kls Exp $
  */
 
 #ifndef __CI_H
@@ -21,6 +21,7 @@ class cCiMenu {
 private:
   enum { MAX_CIMENU_ENTRIES = 64 }; ///< XXX is there a specified maximum?
   cCiMMI *mmi;
+  cMutex mutex;
   bool selectable;
   char *titleText;
   char *subTitleText;
@@ -45,6 +46,7 @@ class cCiEnquiry {
   friend class cCiMMI;
 private:
   cCiMMI *mmi;
+  cMutex mutex;
   char *text;
   bool blind;
   int expectedLength;
diff --git a/config.h b/config.h
index 625e3e65..3771ce1d 100644
--- a/config.h
+++ b/config.h
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: config.h 1.176.1.2 2003/10/24 14:31:17 kls Exp $
+ * $Id: config.h 1.176.1.3 2003/10/26 13:30:36 kls Exp $
  */
 
 #ifndef __CONFIG_H
@@ -19,7 +19,7 @@
 #include "device.h"
 #include "tools.h"
 
-#define VDRVERSION  "1.2.6pre3"
+#define VDRVERSION  "1.2.6pre4"
 #define VDRVERSNUM   10206  // Version * 10000 + Major * 100 + Minor
 
 #define MAXPRIORITY 99