ringbuffer: fix invalid read access

Fix read access to a free'ed memory when waiting for audio data.

Refs #73286

Change-Id: Iefbe6e4540c14a114cd4c8684ff91445eb290922

src/media/audio/ringbuffer.cpp

@@ -266,11 +266,19 @@ size_t RingBuffer::waitForDataAvailable(const std::string &call_id, const size_t
     size_t getl = 0;
     if (deadline == std::chrono::high_resolution_clock::time_point()) {
         not_empty_.wait(l, [=, &getl] {
+                // Re-find read_ptr: it may be destroyed during the wait
+                const auto read_ptr = readoffsets_.find(call_id);
+                if (read_ptr == readoffsets_.end())
+                    return true;
                 getl = (endPos_ + buffer_size - read_ptr->second) % buffer_size;
                 return getl >= min_data_length;
         });
     } else {
         not_empty_.wait_until(l, deadline, [=, &getl]{
+                // Re-find read_ptr: it may be destroyed during the wait
+                const auto read_ptr = readoffsets_.find(call_id);
+                if (read_ptr == readoffsets_.end())
+                    return true;
                 getl = (endPos_ + buffer_size - read_ptr->second) % buffer_size;
                 return getl >= min_data_length;
         });