TT#108003 don't consume `pt` before finish using it

__rtp_payload_type_add_recv takes ownership of `pt` and potentially
freeds it. Move the call to the end of the code block, after we're done
using it.

Change-Id: I5591cd6b22295ddcd6801e2bbbb381bff403fea8

daemon/codec.c

@@ -3416,8 +3416,6 @@ void codec_tracker_finish(struct call_media *media, struct call_media *other_med
 			}
 			struct codec_handler *existing_handler = existing_pt ? codec_handler_get(media, existing_pt->payload_type) : NULL;
 
-			__rtp_payload_type_add_recv(media, pt, 1);
-
 			if (existing_pt && existing_handler) {
 				// since this happens after we ran through the codec matchup, we must create the appropriate handler here
 				struct codec_handler *handler = __get_pt_handler(media, pt);
@@ -3425,6 +3423,7 @@ void codec_tracker_finish(struct call_media *media, struct call_media *other_med
 				__make_transcoder(handler, &existing_handler->dest_pt, NULL, existing_handler->dtmf_payload_type, 0);
 			}
 
+			__rtp_payload_type_add_recv(media, pt, 1);
 			g_free(pt_s);
 		}