Language: C
Label: safe
CWE: CWE-416 \u2014 Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Code:
pjmedia_transport_loop_create2(pjmedia_endpt *endpt,
                               const pjmedia_loop_tp_setting *opt,
                               pjmedia_transport **p_tp)
{
    struct transport_loop *tp;
    pj_pool_t *pool;
    pj_grp_lock_t *grp_lock;
    pj_status_t status;

    /* Sanity check */
    PJ_ASSERT_RETURN(endpt && p_tp, PJ_EINVAL);

    /* Create transport structure */
    pool = pjmedia_endpt_create_pool(endpt, "tploop", 512, 512);
    if (!pool)
        return PJ_ENOMEM;

    tp = PJ_POOL_ZALLOC_T(pool, struct transport_loop);
    tp->pool = pool;
    pj_memcpy(tp->base.name, tp->pool->obj_name, PJ_MAX_OBJ_NAME);
    tp->base.op = &transport_udp_op;
    tp->base.type = PJMEDIA_TRANSPORT_TYPE_UDP;

    /* Create group lock */
    status = pj_grp_lock_create(pool, NULL, &grp_lock);
    if (status != PJ_SUCCESS)
        return status;

    pj_grp_lock_add_ref(grp_lock);
    pj_grp_lock_add_handler(grp_lock, pool, tp, &tp_loop_on_destroy);

    if (opt) {
        tp->setting = *opt;
    } else {
        pjmedia_loop_tp_setting_default(&tp->setting);
    }
    if (tp->setting.addr.slen) {
        pj_strdup(pool, &tp->setting.addr, &opt->addr);
    } else {
        pj_strset2(&tp->setting.addr, (tp->setting.af == pj_AF_INET())?
                                       "127.0.0.1": "::1");
    }
    if (tp->setting.port == 0)
        tp->setting.port = 4000;

    /* alloc users array */
    tp->max_attach_cnt = tp->setting.max_attach_cnt;
    if (tp->max_attach_cnt == 0)
        tp->max_attach_cnt = 1;
    tp->users = (struct tp_user *)pj_pool_calloc(pool, tp->max_attach_cnt, sizeof(struct tp_user));

    /* Done */
    *p_tp = &tp->base;
    return PJ_SUCCESS;
}