Language: C
Label: safe
CWE: CWE-416 \u2014 Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Code:
static pj_status_t transport_send_rtp( pjmedia_transport *tp,
                                       const void *pkt,
                                       pj_size_t size)
{
    struct transport_loop *loop = (struct transport_loop*)tp;
    unsigned i;

    /* Simulate packet lost on TX direction */
    if (loop->tx_drop_pct) {
        if ((pj_rand() % 100) <= (int)loop->tx_drop_pct) {
            PJ_LOG(5,(loop->base.name, 
                      "TX RTP packet dropped because of pkt lost "
                      "simulation"));
            return PJ_SUCCESS;
        }
    }

    /* Simulate packet lost on RX direction */
    if (loop->rx_drop_pct) {
        if ((pj_rand() % 100) <= (int)loop->rx_drop_pct) {
            PJ_LOG(5,(loop->base.name, 
                      "RX RTP packet dropped because of pkt lost "
                      "simulation"));
            return PJ_SUCCESS;
        }
    }

    pj_grp_lock_add_ref(tp->grp_lock);

    /* Distribute to users */
    for (i=0; i<loop->user_cnt; ++i) {
        if (loop->users[i].rx_disabled) continue;
        if (loop->users[i].rtp_cb2) {
            pjmedia_tp_cb_param param;

            pj_bzero(&param, sizeof(param));
            param.user_data = loop->users[i].user_data;
            param.pkt = (void *)pkt;
            param.size = size;
            (*loop->users[i].rtp_cb2)(&param);
        } else if (loop->users[i].rtp_cb) {
            (*loop->users[i].rtp_cb)(loop->users[i].user_data, (void*)pkt, 
                                     size);
        }
    }

    pj_grp_lock_dec_ref(tp->grp_lock);

    return PJ_SUCCESS;
}