libosmo-mgcp-client: fix use-after-free in mgcp_client_tx()

This function calls mgcp_client_pending_add(), that in its turn
allocates a 'mgcp_response_pending' and appends it to the queue.

In case of an error, it calls mgcp_client_handle_response() that
would free the 'mgcp_response_pending', but this structure would
still remain in the linked list (the queue).

Change-Id: Id94bb93a6b0ea7b7241cf7868112e9bec3e60f0b

src/libosmo-mgcp-client/mgcp_client.c

@@ -959,6 +959,8 @@ int mgcp_client_tx(struct mgcp_client *mgcp, struct msgb *msg,
 	return 0;
 
 mgcp_tx_error:
+	/* Dequeue pending response, it's going to be free()d */
+	llist_del(&pending->entry);
 	/* Pass NULL to response cb to indicate an error */
 	mgcp_client_handle_response(mgcp, pending, NULL);
 	return -1;