(gdb) bt

#0  0x080624a5 in ast_channel_spy_add (chan=0x82150b8, spy=0xb781b8b0) at channel.c:999
#1  0xb79547e4 in start_spying (chan=0x82150b8, spychan=0x814acb8, spy=0xb781b8b0) at app_chanspy.c:199
#2  0xb7954b3d in channel_spy (chan=0x814acb8, spyee=0x82150b8, volfactor=0xb781bbe0, fd=0) at app_chanspy.c:282
#3  0xb7955b0f in chanspy_exec (chan=0x814acb8, data=0xb7820070) at app_chanspy.c:516
#4  0x08089c84 in pbx_exec (c=0x814acb8, app=0x8174b48, data=0xb7820070, newstack=1) at pbx.c:544
#5  0x0808d947 in pbx_extension_helper (c=0x814acb8, con=0x0, context=0x814ae08 "default", exten=0x814aefc "178", priority=1, label=0x0,
    callerid=0x818c070 "121", action=1) at pbx.c:1687
#6  0x0808edd4 in ast_spawn_extension (c=0x814acb8, context=0x814ae08 "default", exten=0x814aefc "178", priority=1, callerid=0x818c070 "121") at pbx.c:2220
#7  0x0808f324 in __ast_pbx_run (c=0x814acb8) at pbx.c:2286
#8  0x08090225 in pbx_thread (data=0x814acb8) at pbx.c:2507
#9  0x009ef341 in start_thread () from /lib/tls/libpthread.so.0
#10 0x006abfee in clone () from /lib/tls/libc.so.6



(gdb) bt full

#0  0x080624a5 in ast_channel_spy_add (chan=0x82150b8, spy=0xb781b8b0) at channel.c:999
        __PRETTY_FUNCTION__ = "ast_channel_spy_add"
#1  0xb79547e4 in start_spying (chan=0x82150b8, spychan=0x814acb8, spy=0xb781b8b0) at app_chanspy.c:199
        res = 1
        peer = (struct ast_channel *) 0x0
        __PRETTY_FUNCTION__ = "start_spying"
#2  0xb7954b3d in channel_spy (chan=0x814acb8, spyee=0x82150b8, volfactor=0xb781bbe0, fd=0) at app_chanspy.c:282
        csth = {spy = {list = {next = 0x0}, lock = {__m_reserved = 0, __m_count = 0, __m_owner = 0x0, __m_kind = 1, __m_lock = {__status = 0,
        __spinlock = 0}}, trigger = {__c_lock = {__status = 0, __spinlock = 0}, __c_waiting = 0x0, __padding = '\0' <repeats 27 times>, __align = 0},
    read_queue = {head = 0x0, samples = 0, format = 64}, write_queue = {head = 0x0, samples = 0, format = 64}, flags = 57, status = CHANSPY_RUNNING,
    type = 0xb7955fbe "ChanSpy", read_vol_adjustment = 0, write_vol_adjustment = 0}, fd = 0, volfactor = 0}
        running = 1
        res = 0
        x = 0
        inp = '\0' <repeats 23 times>
        name = 0xb781b830 "SIP/sipbroker-out-7ca6"
        f = (struct ast_frame *) 0x493e0
#3  0xb7955b0f in chanspy_exec (chan=0x814acb8, data=0xb7820070) at app_chanspy.c:516
        x = 7
        group = 0x0
        igrp = 1
        u = (struct localuser *) 0x81c0858
        peer = (struct ast_channel *) 0x82150b8
        prev = (struct ast_channel *) 0x82150b8
        name = '\0' <repeats 224 times>, "\200\"\202·|\"\202·Ð½\201·þÁ\n\bµ?\035\bu\000\202·K\000\000\000\211\215\t\b"
        peer_name = "spy-sip\000sipbroker-out-7ca6", '\0' <repeats 234 times>
        args = 0xb781b960 "Sip"
        ptr = 0xb781bc28 "sipbroker-out-7ca6"
        options = 0xb781b964 "q"
        spec = 0xb781b960 "Sip"
        argv = {0xb781b960 "Sip", 0xb781b964 "q", 0x0, 0x0, 0x0}
        mygroup = 0x0
        recbase = 0x0
        res = 0
        volfactor = 0
        silent = 1
        argc = 2
        bronly = 0
        chosen = 0
        count = 1
        waitms = 100
        num = 0
        oldrf = 4
        oldwf = 4
        fd = 0
        flags = {flags = 1}
        zero_volume = 0 '\0'
        __PRETTY_FUNCTION__ = "chanspy_exec"
#4  0x08089c84 in pbx_exec (c=0x814acb8, app=0x8174b48, data=0xb7820070, newstack=1) at pbx.c:544
        res = 135744328
        saved_c_appl = 0x0
        saved_c_data = 0x0
        execute = (int (*)(struct ast_channel *, void *)) 0xb7954eb9 <chanspy_exec>
        __PRETTY_FUNCTION__ = "pbx_exec"
#5  0x0808d947 in pbx_extension_helper (c=0x814acb8, con=0x0, context=0x814ae08 "default", exten=0x814aefc "178", priority=1, label=0x0,
    callerid=0x818c070 "121", action=1) at pbx.c:1687
        e = (struct ast_exten *) 0x81a46a8
        app = (struct ast_app *) 0x8174b48
        sw = (struct ast_switch *) 0x0
---Type <return> to continue, or q <return> to quit---
        data = 0x0
        foundcontext = 0x81a50fd "local-extensions"
        newstack = 1
        res = 0
        status = 5
        incstack = {0x81a5058 "default", 0x0 <repeats 11 times>, 0x643ce4 "\201Ã\020s\f", 0x0, 0x0, 0x70aff4 "<­p",
  0xb7822100 "\001\200­û`\"\202·`\"\202·`\"\202·`\"\202·t\"\202·¯\"\202·`\"\202·¯\"\202·", 0xb78220dc "ì!\202·6õc",
  0x644ff1 "\211~\020\213U\024\211~\f\211~\004\205Òt6\213U\024\213}ð\211V\024\211V\b1Ò\211~\030\211\226\230",
  0xb7822100 "\001\200­û`\"\202·`\"\202·`\"\202·`\"\202·t\"\202·¯\"\202·`\"\202·¯\"\202·", 0xb7822260 "\"Musicroom PÈ$\202·\005", 0xb78222af "\b\001", 0x0,
  0xb78222af "\b\001", 0x70aff4 "<­p", 0x8106363 "\"%s\" <%s>", 0xb782221c "@\224\034\bpÀ\030\b", 0xb78221ec "\b\"\202·\222tb",
  0x63f536 "\213\215\fÿÿÿ\211Â9\2150ÿÿÿt\t\213µ(ÿÿÿÆ\006", 0xb7822100 "\001\200­û`\"\202·`\"\202·`\"\202·`\"\202·t\"\202·¯\"\202·`\"\202·¯\"\202·",
  0x8106363 "\"%s\" <%s>", 0xb7822224 "", 0xb7822260 "\"Musicroom PÈ$\202·\005", 0x0, 0xb78221a0 "$Èp",
  0xb7822100 "\001\200­û`\"\202·`\"\202·`\"\202·`\"\202·t\"\202·¯\"\202·`\"\202·¯\"\202·", 0xfbad8001 <Address 0xfbad8001 out of bounds>,
  0xb7822260 "\"Musicroom PÈ$\202·\005", 0xb7822260 "\"Musicroom PÈ$\202·\005", 0xb7822260 "\"Musicroom PÈ$\202·\005",
  0xb7822260 "\"Musicroom PÈ$\202·\005", 0xb7822274 "", 0xb78222af "\b\001", 0xb7822260 "\"Musicroom PÈ$\202·\005", 0xb78222af "\b\001",
  0x0 <repeats 12 times>, 0x645f91 "\201ÃcP\f", 0x0, 0xffffffff <Address 0xffffffff out of bounds>, 0x0, 0x0, 0x0, 0x6ff38f "corrupted double-linked list",
  0x6ff38f "corrupted double-linked list", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70aa20 "", 0x0, 0x0, 0x70c824 "", 0x70c828 "", 0x70c800 "", 0x0, 0x0,
  0x0, 0x0, 0x70aff4 "<­p", 0x70c800 "", 0x0, 0xb782228c "¨F\032\b@¿\232Cû£\n",
  0x647143 "éZþÿÿ\213\215\\ÿÿÿ9A\004ë\022\213\225\\ÿÿÿ\213r\b9F\004\211µ\\ÿÿÿwì\213\205\\ÿÿÿ\213p\fé\222þÿÿ\201}àÿ\001", 0x0, 0x0, 0x0, 0x0,
  0x70aff4 "<­p", 0x0, 0xb7822bb0 "°+\202·¤>\027\b°+\202·\001", 0xb7822208 "È$\202·ÐÇ\n\bL@\035\bh°\024\b\024",
  0x627492 "\203Ä\020[]Ã\220\220\220\220\220\220\220\220U\211å\215M\020S\203ì\f\213U\f\211L$\b\213E\bè¸'ýÿ\201Ã;;\016",
  0xb7822260 "\"Musicroom PÈ$\202·\005", 0x50 <Address 0x50 out of bounds>, 0x8106363 "\"%s\" <%s>", 0xb782221c "@\224\034\bpÀ\030\b",
  0x814acb8 "SIP/121-ea8d", 0xb78224c8 "", 0x80ac7d0 "\213\204$À", 0x81d404c "", 0x814b068 "", 0x14 <Address 0x14 out of bounds>, 0x81c9440 "Musicroom PC",
  0x818c070 "121", 0x0, 0x0, 0x0, 0x0, 0x3 <Address 0x3 out of bounds>, 0x81d3d80 "\"Musicroom PC\" <121>", 0x1 <Address 0x1 out of bounds>,
  0x81d3d80 "\"Musicroom PC\" <121>", 0x818c070 "121", 0x818c070 "121", 0x1 <Address 0x1 out of bounds>, 0x1 <Address 0x1 out of bounds>,
  0x81061da "<unknown>", 0x81d3ec0 "SIP/121-ea8d", 0x1 <Address 0x1 out of bounds>, 0x73754d22 <Address 0x73754d22 out of bounds>,
  0x6f726369 <Address 0x6f726369 out of bounds>, 0x50206d6f <Address 0x50206d6f out of bounds>, 0xb78224c8 ""}
        passdata = "Sip|q", '\0' <repeats 8186 times>
        stacklen = 1
        tmp = '\0' <repeats 79 times>
        tmp2 = '\0' <repeats 79 times>
        tmp3 = '\0' <repeats 8191 times>
        atmp = '\0' <repeats 79 times>
        atmp2 = '\0' <repeats 8291 times>
        __PRETTY_FUNCTION__ = "pbx_extension_helper"
#6  0x0808edd4 in ast_spawn_extension (c=0x814acb8, context=0x814ae08 "default", exten=0x814aefc "178", priority=1, callerid=0x818c070 "121") at pbx.c:2220
No locals.
#7  0x0808f324 in __ast_pbx_run (c=0x814acb8) at pbx.c:2286
        firstpass = 0
        digit = 0
        exten = '\0' <repeats 255 times>
        pos = 0
        waittime = 6579524
        res = 0
        autoloopflag = 0
        __PRETTY_FUNCTION__ = "__ast_pbx_run"
#8  0x08090225 in pbx_thread (data=0x814acb8) at pbx.c:2507
        c = (struct ast_channel *) 0x814acb8
#9  0x009ef341 in start_thread () from /lib/tls/libpthread.so.0
No symbol table info available.
#10 0x006abfee in clone () from /lib/tls/libc.so.6
No symbol table info available.


(gdb) thread apply all bt

Thread 15 (process 4713):
#0  0x00000293 in ?? ()
Cannot access memory at address 0x0
0x080624a5      999                     AST_LIST_INSERT_TAIL(&chan->spies->list, spy, list);