audiobridge: fix double free of buffered packet in participant thread

jitter_buffer_get() only assigns jbp.data when it actually returns a
packet, so a failed read leaves there the pointer to the buffered packet
that was already freed at the end of a previous iteration. The PLC branch
then passed that dangling bpkt to janus_audiobridge_buffer_packet_destroy()
whenever it saw participant->decoder == NULL, i.e. exactly when the
participant was being cleaned up concurrently: the packet got freed a
second time and the process crashed inside the allocator.

There is nothing to free in that branch, so drop the call; clear bpkt
after every destroy and reset jbp.data before each read so that a stale
pointer cannot be used again.

Author: spscream

src/plugins/janus_audiobridge.c

@@ -9213,6 +9213,9 @@ static void *janus_audiobridge_participant_thread(void *data) {
 			before += 20000;
 			if(participant->jitter) {
 				janus_mutex_lock(&participant->qmutex);
+				/* jitter_buffer_get() only sets jbp.data when it actually returns a packet,
+				 * so clear it first to make sure a failed read leaves no stale pointer */
+				jbp.data = NULL;
 				ret = jitter_buffer_get(participant->jitter, &jbp, participant->codec == JANUS_AUDIOCODEC_OPUS ? 960 : 160, NULL);
 				jitter_ticks++;
 				/* Adjust the buffer size every 50 ticks (~1 second) */
@@ -9230,7 +9233,10 @@ static void *janus_audiobridge_participant_thread(void *data) {
 						if(participant->decoder == NULL) {
 							/* This means we're cleaning up, so don't try to decode */
 							janus_mutex_unlock(&participant->decoding_mutex);
-							janus_audiobridge_buffer_packet_destroy(bpkt);
+							/* Notice that we have no buffered packet to get rid of here: we
+							 * only got to this branch because the jitter buffer had nothing
+							 * for us, so bpkt is either NULL or a dangling pointer to the
+							 * packet we already freed in a previous iteration */
 							break;
 						}
 						int32_t output_samples = 0;
@@ -9286,6 +9292,7 @@ static void *janus_audiobridge_participant_thread(void *data) {
 						JANUS_LOG(LOG_ERR, "[%s] Ops! got an error accessing the RTP payload\n",
 							participant->codec == JANUS_AUDIOCODEC_OPUS ? "Opus" : "G.711");
 						janus_audiobridge_buffer_packet_destroy(bpkt);
+						bpkt = NULL;
 						continue;
 					}
 					rtp = (janus_rtp_header *)buffer;
@@ -9308,6 +9315,7 @@ static void *janus_audiobridge_participant_thread(void *data) {
 							/* This means we're cleaning up, so don't try to decode */
 							janus_mutex_unlock(&participant->decoding_mutex);
 							janus_audiobridge_buffer_packet_destroy(bpkt);
+							bpkt = NULL;
 							break;
 						}
 						pkt->length = opus_decode(participant->decoder, payload, plen, (opus_int16 *)pkt->data, BUFFER_SAMPLES, 0);
@@ -9317,6 +9325,7 @@ static void *janus_audiobridge_participant_thread(void *data) {
 						if(plen != 160) {
 							JANUS_LOG(LOG_WARN, "[G.711] Wrong packet size (expected 160, got %d), skipping audio packet\n", plen);
 							janus_audiobridge_buffer_packet_destroy(bpkt);
+							bpkt = NULL;
 							g_free(pkt->data);
 							g_free(pkt);
 							continue;
@@ -9341,6 +9350,7 @@ static void *janus_audiobridge_participant_thread(void *data) {
 #endif
 					/* Get rid of the buffered packet */
 					janus_audiobridge_buffer_packet_destroy(bpkt);
+					bpkt = NULL;
 					/* Update the details */
 					participant->last_seq = pkt->seq_number;
 					participant->last_timestamp = pkt->timestamp;