(gdb) bt
#0  0x0806272f in ast_channel_spy_remove (chan=0x820d9d0, spy=0xb78818b0) at channel.c:1052
#1  0xb791e7d3 in stop_spying (chan=0x820d9d0, spy=0xb78818b0) at app_chanspy.c:190
#2  0xb791ed33 in channel_spy (chan=0x8177120, spyee=0x820d9d0, volfactor=0xb7881be0, fd=0) at app_chanspy.c:310
#3  0xb791fa7c in chanspy_exec (chan=0x8177120, data=0xb7886070) at app_chanspy.c:493
#4  0x08089cd4 in pbx_exec (c=0x8177120, app=0x81bbb60, data=0xb7886070, newstack=1) at pbx.c:544
#5  0x0808d997 in pbx_extension_helper (c=0x8177120, con=0x0, context=0x8177270 "default", exten=0x8177364 "178", priority=1, label=0x0,
    callerid=0x81cb088 "121", action=1) at pbx.c:1687
#6  0x0808ee24 in ast_spawn_extension (c=0x8177120, context=0x8177270 "default", exten=0x8177364 "178", priority=1, callerid=0x81cb088 "121") at pbx.c:2220
#7  0x0808f374 in __ast_pbx_run (c=0x8177120) at pbx.c:2286
#8  0x08090275 in pbx_thread (data=0x8177120) at pbx.c:2507
#9  0x009ef341 in start_thread () from /lib/tls/libpthread.so.0
#10 0x006abfee in clone () from /lib/tls/libc.so.6
(gdb) thread apply all bt

Thread 15 (process 16931):
#0  0x00000293 in ?? ()
Cannot access memory at address 0x0
0x0806272f      1052                    while (curspy->list.next != (spy))
(gdb) bt full
#0  0x0806272f in ast_channel_spy_remove (chan=0x820d9d0, spy=0xb78818b0) at channel.c:1052
        curspy = (struct ast_channel_spy *) 0x0
        f = (struct ast_frame *) 0xb7921ca4
        __PRETTY_FUNCTION__ = "ast_channel_spy_remove"
#1  0xb791e7d3 in stop_spying (chan=0x820d9d0, spy=0xb78818b0) at app_chanspy.c:190
No locals.
#2  0xb791ed33 in channel_spy (chan=0x8177120, spyee=0x820d9d0, volfactor=0xb7881be0, fd=0) at app_chanspy.c:310
        csth = {spy = {list = {next = 0xb78818b0}, lock = {__m_reserved = 0, __m_count = 0, __m_owner = 0x0, __m_kind = 1, __m_lock = {__status = 0,
        __spinlock = 0}}, trigger = {__c_lock = {__status = 0, __spinlock = 0}, __c_waiting = 0x0, __padding = '\0' <repeats 27 times>, __align = 0},
    read_queue = {head = 0x0, samples = 0, format = 64}, write_queue = {head = 0x0, samples = 0, format = 64}, flags = 57, status = CHANSPY_RUNNING,
    type = 0xb791ff5e "ChanSpy", read_vol_adjustment = 0, write_vol_adjustment = 0}, fd = 0, volfactor = 0}
        running = 0
        res = 42
        x = 0
        inp = '\0' <repeats 23 times>
        name = 0xb7881830 "SIP/sipbroker-out-8e75"
        f = (struct ast_frame *) 0x81d7df0
#3  0xb791fa7c in chanspy_exec (chan=0x8177120, data=0xb7886070) at app_chanspy.c:493
        x = 7
        group = 0x0
        igrp = 1
        u = (struct localuser *) 0x814d558
        peer = (struct ast_channel *) 0x820d9d0
        prev = (struct ast_channel *) 0x820d9d0
        name = '\0' <repeats 224 times>, "\200\202\210·|\202\210·Ð\035\210·\"Â\n\bUÏ\024\bu`\210·K\000\000\000ô\215\t\b"
        peer_name = "spy-sip\000sipbroker-out-8e75", '\0' <repeats 234 times>
        args = 0xb7881960 "Sip"
        ptr = 0xb7881c28 "sipbroker-out-8e75"
        options = 0xb7881964 "q"
        spec = 0xb7881960 "Sip"
        argv = {0xb7881960 "Sip", 0xb7881964 "q", 0x0, 0x0, 0x0}
        mygroup = 0x0
        recbase = 0x0
        res = 0
        volfactor = 0
        silent = 1
        argc = 2
        bronly = 0
        chosen = 0
        count = 1
        waitms = 100
        num = 0
        oldrf = 4
        oldwf = 4
        fd = 0
        flags = {flags = 1}
        zero_volume = 0 '\0'
        __PRETTY_FUNCTION__ = "chanspy_exec"
#4  0x08089cd4 in pbx_exec (c=0x8177120, app=0x81bbb60, data=0xb7886070, newstack=1) at pbx.c:544
        res = 136035168
        saved_c_appl = 0x0
        saved_c_data = 0x0
        execute = (int (*)(struct ast_channel *, void *)) 0xb791ede6 <chanspy_exec>
        __PRETTY_FUNCTION__ = "pbx_exec"
#5  0x0808d997 in pbx_extension_helper (c=0x8177120, con=0x0, context=0x8177270 "default", exten=0x8177364 "178", priority=1, label=0x0,
    callerid=0x81cb088 "121", action=1) at pbx.c:1687
        e = (struct ast_exten *) 0x81a7b98
        app = (struct ast_app *) 0x81bbb60
        sw = (struct ast_switch *) 0x0
---Type <return> to continue, or q <return> to quit---
        data = 0x0
        foundcontext = 0x81a866d "local-extensions"
        newstack = 1
        res = 0
        status = 5
        incstack = {0x81a85c8 "default", 0x0 <repeats 11 times>, 0x643ce4 "\201Ã\020s\f", 0x0, 0x0, 0x70aff4 "<­p",
  0xb7888100 "\001\200­û`\202\210·`\202\210·`\202\210·`\202\210·t\202\210·¯\202\210·`\202\210·¯\202\210·", 0xb78880dc "ì\201\210·6õc",
  0x644ff1 "\211~\020\213U\024\211~\f\211~\004\205Òt6\213U\024\213}ð\211V\024\211V\b1Ò\211~\030\211\226\230",
  0xb7888100 "\001\200­û`\202\210·`\202\210·`\202\210·`\202\210·t\202\210·¯\202\210·`\202\210·¯\202\210·", 0xb7888260 "\"Musicroom PÈ\204\210·\005",
  0xb78882af "\b\001", 0x0, 0xb78882af "\b\001", 0x70aff4 "<­p", 0x8106383 "\"%s\" <%s>", 0xb788821c "¸·\034\b\210°\034\b ",
  0xb78881ec "\b\202\210·\222tb", 0x63f536 "\213\215\fÿÿÿ\211Â9\2150ÿÿÿt\t\213µ(ÿÿÿÆ\006",
  0xb7888100 "\001\200­û`\202\210·`\202\210·`\202\210·`\202\210·t\202\210·¯\202\210·`\202\210·¯\202\210·", 0x8106383 "\"%s\" <%s>", 0xb7888224 " ",
  0xb7888260 "\"Musicroom PÈ\204\210·\005", 0x0, 0xb78881a0 "$Èp",
  0xb7888100 "\001\200­û`\202\210·`\202\210·`\202\210·`\202\210·t\202\210·¯\202\210·`\202\210·¯\202\210·", 0xfbad8001 <Address 0xfbad8001 out of bounds>,
  0xb7888260 "\"Musicroom PÈ\204\210·\005", 0xb7888260 "\"Musicroom PÈ\204\210·\005", 0xb7888260 "\"Musicroom PÈ\204\210·\005",
  0xb7888260 "\"Musicroom PÈ\204\210·\005", 0xb7888274 "", 0xb78882af "\b\001", 0xb7888260 "\"Musicroom PÈ\204\210·\005", 0xb78882af "\b\001",
  0x0 <repeats 12 times>, 0x645f91 "\201ÃcP\f", 0x0, 0xffffffff <Address 0xffffffff out of bounds>, 0x0, 0x0, 0x0, 0x6ff38f "corrupted double-linked list",
  0x6ff38f "corrupted double-linked list", 0x6ff38f "corrupted double-linked list", 0x6ff38f "corrupted double-linked list", 0x0, 0x0, 0x0, 0x0, 0x0,
  0x68 <Address 0x68 out of bounds>, 0x70aa20 "", 0x0, 0x0, 0x70c824 "", 0x70c828 "", 0x70c800 "", 0x0, 0x0, 0x0, 0x0, 0x70aff4 "<­p", 0x70c800 "", 0x0,
  0xb788828c "\230{\032\b\216\201\237C¦!\001",
  0x647143 "éZþÿÿ\213\215\\ÿÿÿ9A\004ë\022\213\225\\ÿÿÿ\213r\b9F\004\211µ\\ÿÿÿwì\213\205\\ÿÿÿ\213p\fé\222þÿÿ\201}àÿ\001", 0x0, 0x0, 0x0, 0x0,
  0x70aff4 "<­p", 0x0, 0xb7888bb0 "°\213\210·\034:\030\b°\213\210·\001", 0xb7888208 "È\204\210·ôÇ\n\bìÏ\024\bÐt\027\b\024",
  0x627492 "\203Ä\020[]Ã\220\220\220\220\220\220\220\220U\211å\215M\020S\203ì\f\213U\f\211L$\b\213E\bè¸'ýÿ\201Ã;;\016",
  0xb7888260 "\"Musicroom PÈ\204\210·\005", 0x50 <Address 0x50 out of bounds>, 0x8106383 "\"%s\" <%s>", 0xb788821c "¸·\034\b\210°\034\b ",
  0x8177120 "SIP/121-1717", 0xb78884c8 "", 0x80ac7f4 "\213\204$À", 0x814cfec "", 0x81774d0 "", 0x14 <Address 0x14 out of bounds>, 0x81cb7b8 "Musicroom PC",
  0x81cb088 "121", 0x20 <Address 0x20 out of bounds>, 0x70c800 "", 0xb7888290 "\216\201\237C¦!\001", 0x6ff3e1 "malloc(): memory corruption",
  0x3 <Address 0x3 out of bounds>, 0x814cd20 "\"Musicroom PC\" <121>", 0x1 <Address 0x1 out of bounds>, 0x814cd20 "\"Musicroom PC\" <121>",
  0x81cb088 "121", 0x81cb088 "121", 0x1 <Address 0x1 out of bounds>, 0x1 <Address 0x1 out of bounds>, 0x81061fa "<unknown>", 0x814ce60 "SIP/121-1717",
  0x1 <Address 0x1 out of bounds>, 0x73754d22 <Address 0x73754d22 out of bounds>, 0x6f726369 <Address 0x6f726369 out of bounds>,
  0x50206d6f <Address 0x50206d6f out of bounds>, 0xb78884c8 ""}
        passdata = "Sip|q", '\0' <repeats 8186 times>
        stacklen = 1
        tmp = '\0' <repeats 79 times>
        tmp2 = '\0' <repeats 79 times>
        tmp3 = '\0' <repeats 8191 times>
        atmp = '\0' <repeats 79 times>
        atmp2 = '\0' <repeats 8291 times>
        __PRETTY_FUNCTION__ = "pbx_extension_helper"
#6  0x0808ee24 in ast_spawn_extension (c=0x8177120, context=0x8177270 "default", exten=0x8177364 "178", priority=1, callerid=0x81cb088 "121") at pbx.c:2220
No locals.
#7  0x0808f374 in __ast_pbx_run (c=0x8177120) at pbx.c:2286
        firstpass = 0
        digit = 0
        exten = '\0' <repeats 255 times>
        pos = 0
        waittime = 6579524
        res = 0
        autoloopflag = 0
        __PRETTY_FUNCTION__ = "__ast_pbx_run"
#8  0x08090275 in pbx_thread (data=0x8177120) at pbx.c:2507
        c = (struct ast_channel *) 0x8177120
#9  0x009ef341 in start_thread () from /lib/tls/libpthread.so.0
No symbol table info available.
#10 0x006abfee in clone () from /lib/tls/libc.so.6
No symbol table info available.
(gdb)