Language: C
Label: safe
CWE: CWE-416 \u2014 Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Code:
static pj_status_t dtls_create(transport_srtp *srtp,
                               pjmedia_transport **p_keying)
{
    dtls_srtp *ds;
    pj_pool_t *pool;
    pj_status_t status;

    pool = pj_pool_create(srtp->pool->factory, "dtls%p",
                          2000, 256, NULL);
    ds = PJ_POOL_ZALLOC_T(pool, dtls_srtp);
    ds->pool = pool;

    pj_ansi_strxcpy(ds->base.name, pool->obj_name, PJ_MAX_OBJ_NAME);
    ds->base.type = (pjmedia_transport_type)PJMEDIA_SRTP_KEYING_DTLS_SRTP;
    ds->base.op = &dtls_op;
    ds->base.user_data = srtp;
    ds->srtp = srtp;

    /* Setup group lock handler for destroy and callback synchronization */
    if (srtp->base.grp_lock) {
        pj_grp_lock_t *grp_lock = srtp->base.grp_lock;

        ds->base.grp_lock = grp_lock;
        pj_grp_lock_add_ref(grp_lock);
        pj_grp_lock_add_handler(grp_lock, pool, ds, &dtls_on_destroy);
    } else {
        status = pj_lock_create_simple_mutex(ds->pool, "dtls_ssl_lock%p",
                                             &ds->ossl_lock);
        if (status != PJ_SUCCESS)
            return status;
    }

    *p_keying = &ds->base;
    PJ_LOG(5,(srtp->pool->obj_name, "SRTP keying DTLS-SRTP created"));
    return PJ_SUCCESS;
}