res/res_pjsip_t38: fix incorrect increment of media_count

The T38 sdp callback incorrectly has a side effect of incrementing
the media_count.  This can lead to core dumps.

Change-Id: I7bb2f4987de4046ec52cfc34e5ea0662dae32af8

diff --git a/res/res_pjsip_t38.c b/res/res_pjsip_t38.c
index 76434928e70ada80ceffff11bbb7c6ca5c425dee..3028d35f600f1e9b5e3ecb695dfb806f88bddd5e 100644 (file)
--- a/res/res_pjsip_t38.c
+++ b/res/res_pjsip_t38.c
@@ -278,7 +278,7 @@ static int t38_reinvite_sdp_cb(struct ast_sip_session *session, pjmedia_sdp_sess
        /* Move the image media stream to the front and have it as the only stream, pjmedia will fill in
         * dummy streams for the rest
         */
-       for (stream = 0; stream < sdp->media_count++; ++stream) {
+       for (stream = 0; stream < sdp->media_count; ++stream) {
                if (!pj_strcmp2(&sdp->media[stream]->desc.media, "image")) {
                        sdp->media[0] = sdp->media[stream];
                        sdp->media_count = 1;