Make sure that we unref the correct object when ejecting the most recent caller.

Currently, when we kick the last user to enter, we decrement our own reference
count which results in a crash when we kick another user or when we exit the
conference ourselves.

This will fix #18225 in 1.8 and trunk, but that particular bug does not exist in
1.6.2.

(closes issue #18225)
Reported by: kenji
Patches:
      issue18225.patch uploaded by seanbright (license 71)
Tested by: seanbright


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.2@304729 65c4cc65-6c06-0410-ace0-fbb531ad65f3

apps/app_meetme.c

@@ -2052,7 +2052,6 @@ static void set_user_talking(struct ast_channel *chan, struct ast_conference *co
 static int conf_run(struct ast_channel *chan, struct ast_conference *conf, int confflags, char *optargs[])
 {
 	struct ast_conf_user *user = NULL;
-	struct ast_conf_user *usr = NULL;
 	int fd;
 	struct dahdi_confinfo dahdic, dahdic_empty;
 	struct ast_frame *f;
@@ -3055,6 +3054,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, int c
 								break;
 							case '3': /* Eject last user */
 							{
+								struct ast_conf_user *usr = NULL;
 								int max_no = 0;
 								menu_active = 0;
 								ao2_callback(conf->usercontainer, OBJ_NODATA, user_max_cmp, &max_no);
@@ -3065,7 +3065,7 @@ static int conf_run(struct ast_channel *chan, struct ast_conference *conf, int c
 								} else {
 									usr->adminflags |= ADMINFLAG_KICKME;
 								}
-								ao2_ref(user, -1);
+								ao2_ref(usr, -1);
 								ast_stopstream(chan);
 								break;
 							}