sipaccount: fix free'ed memory access

Discovered using ASAN.
useUPnPAddressPortInVIA() stores getUPnPIpAddress().toString() result as pointer
but this last is a stack allocated object.

Refs #74409

Change-Id: I63bbb247225e31ca102b429dec4cb713ce4b7783

src/sip/sipaccount.cpp

@@ -474,8 +474,9 @@ void SIPAccount::usePublishedAddressPortInVIA()
 
 void SIPAccount::useUPnPAddressPortInVIA()
 {
-    via_addr_.host.ptr = (char *) getUPnPIpAddress().toString().c_str();
-    via_addr_.host.slen = getUPnPIpAddress().toString().size();
+    upnpIpAddr_ = getUPnPIpAddress().toString();
+    via_addr_.host.ptr = (char *) upnpIpAddr_.c_str();
+    via_addr_.host.slen = upnpIpAddr_.size();
     via_addr_.port = publishedPortUsed_;
 }
 

src/sip/sipaccount.h

@@ -768,6 +768,12 @@ class SIPAccount : public SIPAccountBase {
          */
         pjsip_host_port via_addr_;
 
+        /**
+         * Temporary storage for getUPnPIpAddress().toString()
+         * Used only by useUPnPAddressPortInVIA().
+         */
+        std::string upnpIpAddr_;
+
         char contactBuffer_[PJSIP_MAX_URL_SIZE];
         pj_str_t contact_;
         int contactRewriteMethod_;