Fix #10302.

- In the case of an error while unflattening, BMediaRoster::GetParameterWebFor()
would allocate a new parameter web object into the passed in web pointer, and
then delete it again. This would result in the desklink MixerControl object having
a bogus pointer in its fParameterWeb member, leading to a crash. As such, create
the object in a local variable first, and only overwrite the passed in pointer on
success. Furthermore, explicitly reset said pointer to NULL in desklink on failure,
as _Disconnect() tries to delete it unconditionally.

src/bin/desklink/MixerControl.cpp

@@ -158,6 +158,7 @@ retry:
 				}
 			} else {
 				errorString = "No parameter web";
+				fParameterWeb = NULL;
 			}
 		} else {
 			if (!retrying) {

src/kits/media/MediaRoster.cpp

@@ -2262,8 +2262,8 @@ BMediaRoster::GetParameterWebFor(const media_node& node, BParameterWeb** _web)
 		}
 		if (reply.size > 0) {
 			// we got a flattened parameter web!
-			*_web = new (std::nothrow) BParameterWeb();
+			BParameterWeb* web = new (std::nothrow) BParameterWeb();
-			if (*_web == NULL)
+			if (web == NULL)
 				rv = B_NO_MEMORY;
 			else {
 				printf("BMediaRoster::GetParameterWebFor Unflattening %"
@@ -2272,13 +2272,15 @@ BMediaRoster::GetParameterWebFor(const media_node& node, BParameterWeb** _web)
 					((uint32*)data)[0], ((uint32*)data)[1], ((uint32*)data)[2],
 					((uint32*)data)[3]);
 
-				rv = (*_web)->Unflatten(reply.code, data, reply.size);
+				rv = web->Unflatten(reply.code, data, reply.size);
-			}
 				if (rv != B_OK) {
 					ERROR("BMediaRoster::GetParameterWebFor Unflatten failed, "
 						"%s\n", strerror(rv));
-				delete *_web;
+					delete web;
+				} else
+					*_web = web;
 			}
+
 			delete_area(area);
 			return rv;
 		}