Description: Fix use-after-free in Node::remove*Callback

If the node holds the only reference to the callback (nc itself isn't
a ref_ptr so doesn't count), it will automatically be freed when
removed, and the following nc->setNestedCallback(0) is hence an
out of bounds access.

Origin: upstream https://github.com/openscenegraph/osg/commit/49d560f4d9d0641c98df67264b7ace4733c6b9a9
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765855
=====================================
--- a/OpenSceneGraph/include/osg/Node
+++ b/OpenSceneGraph/include/osg/Node
@@ -203,8 +203,9 @@ class OSG_EXPORT Node : public Object
             if (nc != NULL && _updateCallback.valid()) {
                 if (_updateCallback == nc)
                 {
-                    setUpdateCallback(nc->getNestedCallback());        // replace the callback by the nested one
+                    ref_ptr<NodeCallback> new_nested_callback = nc->getNestedCallback();
                     nc->setNestedCallback(0);
+                    setUpdateCallback(new_nested_callback.get());
                 }
                 else _updateCallback->removeNestedCallback(nc);
             }
@@ -237,8 +238,9 @@ class OSG_EXPORT Node : public Object
             if (nc != NULL && _eventCallback.valid()) {
                 if (_eventCallback == nc)
                 {
-                    setEventCallback(nc->getNestedCallback());        // replace the callback by the nested one
+                    ref_ptr<NodeCallback> new_nested_callback = nc->getNestedCallback();
                     nc->setNestedCallback(0);
+                    setEventCallback(new_nested_callback.get());        // replace the callback by the nested one
                 }
                 else _eventCallback->removeNestedCallback(nc);
             }
@@ -271,8 +273,9 @@ class OSG_EXPORT Node : public Object
             if (nc != NULL && _cullCallback.valid()) {
                 if (_cullCallback == nc)
                 {
-                    setCullCallback(nc->getNestedCallback());        // replace the callback by the nested one
+                    ref_ptr<NodeCallback> new_nested_callback = nc->getNestedCallback();
                     nc->setNestedCallback(0);
+                    setCullCallback(new_nested_callback.get());        // replace the callback by the nested one
                 }
                 else _cullCallback->removeNestedCallback(nc);
             }

