Language: C
Label: safe
CWE: CWE-416 \u2014 Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Code:
PJ_DEF(pj_status_t) pjmedia_tp_adapter_create( pjmedia_endpt *endpt,
                                               const char *name,
                                               pjmedia_transport *transport,
                                               pj_bool_t del_base,
                                               pjmedia_transport **p_tp)
{
    pj_pool_t *pool;
    struct tp_adapter *adapter;

    if (name == NULL)
        name = "tpad%p";

    /* Create the pool and initialize the adapter structure */
    pool = pjmedia_endpt_create_pool(endpt, name, 512, 512);
    adapter = PJ_POOL_ZALLOC_T(pool, struct tp_adapter);
    adapter->pool = pool;
    pj_ansi_strxcpy(adapter->base.name, pool->obj_name, 
                    sizeof(adapter->base.name));
    adapter->base.type = (pjmedia_transport_type)
                         (PJMEDIA_TRANSPORT_TYPE_USER + 1);
    adapter->base.op = &tp_adapter_op;

    /* Save the transport as the slave transport */
    adapter->slave_tp = transport;
    adapter->del_base = del_base;

    /* Setup group lock handler for destroy and callback synchronization */
    if (transport && transport->grp_lock) {
        pj_grp_lock_t *grp_lock = transport->grp_lock;

        adapter->base.grp_lock = grp_lock;
        pj_grp_lock_add_ref(grp_lock);
        pj_grp_lock_add_handler(grp_lock, pool, adapter, &adapter_on_destroy);
    }

    /* Done */
    *p_tp = &adapter->base;
    return PJ_SUCCESS;
}