bridge: avoid leaking channel during blond transfer

After a blond transfer (start attended and hang up)
to a destination that also hangs up without answer,
the Local;1 channel was leaked and would show up on
core show channels.  This was happening because the
attended state blond_nonfinal_enter() resetting the
props->transfer_target to null while releasing it's
own reference, which would later prevent props from
releasing another reference during destruction. The
change made here is simply to not assign the target
to NULL.

ASTERISK-24513 #close
Reported by: Mark Michelson
Review: https://reviewboard.asterisk.org/r/4262/
........

Merged revisions 429826 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@429827 65c4cc65-6c06-0410-ace0-fbb531ad65f3

main/bridge_basic.c

@@ -2263,7 +2263,8 @@ static int blond_nonfinal_enter(struct attended_transfer_properties *props)
 	props->superstate = SUPERSTATE_RECALL;
 	props->recall_target = ast_channel_ref(props->transfer_target);
 	res = blond_enter(props);
-	props->transfer_target = ast_channel_unref(props->transfer_target);
+	/* transfer properties holds a separate reference to transfer_target, don't set it to NULL here */
+	ast_channel_unref(props->transfer_target);
 	return res;
 }