Language: C
Label: safe
CWE: CWE-416 \u2014 Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Code:
static pj_status_t transport_send_rtcp2(pjmedia_transport *tp,
                                        const pj_sockaddr_t *addr,
                                        unsigned addr_len,
                                        const void *pkt,
                                        pj_size_t size)
{
    struct transport_loop *loop = (struct transport_loop*)tp;
    unsigned i;

    PJ_UNUSED_ARG(addr_len);
    PJ_UNUSED_ARG(addr);

    pj_grp_lock_add_ref(tp->grp_lock);

    /* Distribute to users */
    for (i=0; i<loop->user_cnt; ++i) {
        if (!loop->users[i].rx_disabled && loop->users[i].rtcp_cb)
            (*loop->users[i].rtcp_cb)(loop->users[i].user_data, (void*)pkt,
                                      size);
    }

    pj_grp_lock_dec_ref(tp->grp_lock);

    return PJ_SUCCESS;
}