MT#55283 fix use-after-free

Grab the correct list link when inserting in the middle of the list.

Change-Id: I4ae484ba05f5e4be827101193952653c21c47ad3
(cherry picked from commit 3f5a22d)
(cherry picked from commit 77738f1)

daemon/codec.c

@@ -4263,11 +4263,14 @@ static void codec_store_add_raw_link(struct codec_store *cs, struct rtp_payload_
 			STR_FMT(&pt->encoding_with_full_params), link);
 	g_hash_table_insert(cs->codecs, GINT_TO_POINTER(pt->payload_type), pt);
 	__rtp_payload_type_add_name(cs->codec_names, pt);
-	if (!link)
+	if (!link) {
 		g_queue_push_tail(&cs->codec_prefs, pt);
-	else
+		pt->prefs_link = cs->codec_prefs.tail;
+	}
+	else {
 		g_queue_insert_before(&cs->codec_prefs, link, pt);
-	pt->prefs_link = cs->codec_prefs.tail;
+		pt->prefs_link = link->prev;
+	}
 	if (!cs->supp_link && pt->codec_def && pt->codec_def->supplemental)
 		cs->supp_link = pt->prefs_link;
 }