osmux: delete message from output list before calling tx_cb

Valgrind complains about a possible use after free:

==12800== Invalid read of size 4
==12800==    at 0x4073DF6: osmux_tx_sched (linuxlist.h:119)
==12800==    by 0x8052B0F: osmux_read_from_bsc_nat_cb (osmux.c:261)
==12800==    by 0x453F967: ???
==12800==  Address 0x453f710 is 48 bytes inside a block of size 145
+free'd
==12800==    at 0x402750C: free (vg_replace_malloc.c:427)
==12800==    by 0x4064ADE: talloc_free (talloc.c:609)
==12800==    by 0x405AAAA: msgb_free (msgb.c:72)
==12800==    by 0x8052492: scheduled_tx_bts_cb (osmux.c:196)
==12800==    by 0x4072CF8: osmux_tx_cb (osmux.c:554)
==12800==    by 0x4073F03: osmux_tx_sched (osmux.c:582)
==12800==    by 0x8052B0F: osmux_read_from_bsc_nat_cb (osmux.c:261)
==12800==    by 0x453F967: ???

The problem is that osmux_tx_sched may immediately call osmux_tx_cb for
the first extracted RTP message from the osmux batch, which releases the
message after that.

Remove the message from our list of messages to be transmitted before
the message is passed to the tx callback.

Reported by Mattias Lundstrom.

0 files changed, 0 insertions, 0 deletions