(gdb) bt
#0  0x080624a5 in ast_channel_spy_add (chan=0x81f47c0, spy=0xb77f58b0) at channel.c:999
#1  0xb791b711 in start_spying (chan=0x81f47c0, spychan=0x814b010, spy=0xb77f58b0) at app_chanspy.c:169
#2  0xb791ba6a in channel_spy (chan=0x814b010, spyee=0x81f47c0, volfactor=0xb77f5be0, fd=0)
    at app_chanspy.c:252
#3  0xb791ca7c in chanspy_exec (chan=0x814b010, data=0xb77fa070) at app_chanspy.c:493
#4  0x08089cf4 in pbx_exec (c=0x814b010, app=0x81b44c8, data=0xb77fa070, newstack=1) at pbx.c:544
#5  0x0808d9b7 in pbx_extension_helper (c=0x814b010, con=0x0, context=0x814b160 "default",
    exten=0x814b254 "178", priority=1, label=0x0, callerid=0x817c690 "121", action=1) at pbx.c:1687
#6  0x0808ee44 in ast_spawn_extension (c=0x814b010, context=0x814b160 "default", exten=0x814b254 "178",
    priority=1, callerid=0x817c690 "121") at pbx.c:2220
#7  0x0808f394 in __ast_pbx_run (c=0x814b010) at pbx.c:2286
#8  0x08090295 in pbx_thread (data=0x814b010) at pbx.c:2507
#9  0x009ef341 in start_thread () from /lib/tls/libpthread.so.0
#10 0x006abfee in clone () from /lib/tls/libc.so.6

(gdb) bt full
#0  0x080624a5 in ast_channel_spy_add (chan=0x81f47c0, spy=0xb77f58b0) at channel.c:999
        __PRETTY_FUNCTION__ = "ast_channel_spy_add"
#1  0xb791b711 in start_spying (chan=0x81f47c0, spychan=0x814b010, spy=0xb77f58b0) at app_chanspy.c:169
        res = 1
        peer = (struct ast_channel *) 0x0
        __PRETTY_FUNCTION__ = "start_spying"
#2  0xb791ba6a in channel_spy (chan=0x814b010, spyee=0x81f47c0, volfactor=0xb77f5be0, fd=0)
    at app_chanspy.c:252
        csth = {spy = {list = {next = 0x0}, lock = {__m_reserved = 0, __m_count = 0, __m_owner = 0x0,
      __m_kind = 1, __m_lock = {__status = 0, __spinlock = 0}}, trigger = {__c_lock = {__status = 0,
        __spinlock = 0}, __c_waiting = 0x0, __padding = '\0' <repeats 27 times>, __align = 0}, read_queue = {
      head = 0x0, samples = 0, format = 64}, write_queue = {head = 0x0, samples = 0, format = 64},
    flags = 57, status = CHANSPY_RUNNING, type = 0xb791cf5e "ChanSpy", read_vol_adjustment = 0,
    write_vol_adjustment = 0}, fd = 0, volfactor = 0}
        running = 1
        res = 0
        x = 0
        inp = '\0' <repeats 23 times>
        name = 0xb77f5840 "SIP/125-a5a0"
        f = (struct ast_frame *) 0x81c80b0
#3  0xb791ca7c in chanspy_exec (chan=0x814b010, data=0xb77fa070) at app_chanspy.c:493
        x = 7
        group = 0x0
        igrp = 1
        u = (struct localuser *) 0x815e7a8
        peer = (struct ast_channel *) 0x81f47c0
        prev = (struct ast_channel *) 0x81f47c0
        name = '\0' <repeats 224 times>, "\200Â\177·|Â\177·Ð]\177·\232Â\n\bM¶\024\bu \177·K\000\000\000ù\215\t\b"
        peer_name = "spy-sip\000125-a5a0", '\0' <repeats 244 times>
        args = 0xb77f5960 "Sip"
        ptr = 0xb77f5c28 "125-a5a0"
        options = 0xb77f5964 "q"
        spec = 0xb77f5960 "Sip"
        argv = {0xb77f5960 "Sip", 0xb77f5964 "q", 0x0, 0x0, 0x0}
        mygroup = 0x0
        recbase = 0x0
        res = 0
        volfactor = 0
        silent = 1
        argc = 2
        bronly = 0
        chosen = 0
        count = 2
        waitms = 100
        num = 0
        oldrf = 4
        oldwf = 4
        fd = 0
        flags = {flags = 1}
        zero_volume = 0 '\0'
        __PRETTY_FUNCTION__ = "chanspy_exec"
#4  0x08089cf4 in pbx_exec (c=0x814b010, app=0x81b44c8, data=0xb77fa070, newstack=1) at pbx.c:544
---Type <return> to continue, or q <return> to quit---
        res = 136004808
        saved_c_appl = 0x0
        saved_c_data = 0x0
        execute = (int (*)(struct ast_channel *, void *)) 0xb791bde6 <chanspy_exec>
        __PRETTY_FUNCTION__ = "pbx_exec"
#5  0x0808d9b7 in pbx_extension_helper (c=0x814b010, con=0x0, context=0x814b160 "default",
    exten=0x814b254 "178", priority=1, label=0x0, callerid=0x817c690 "121", action=1) at pbx.c:1687
        e = (struct ast_exten *) 0x819e7d0
        app = (struct ast_app *) 0x81b44c8
        sw = (struct ast_switch *) 0x0
        data = 0x0
        foundcontext = 0x819f225 "local-extensions"
        newstack = 1
        res = 0
        status = 5
        incstack = {0x819f180 "default", 0x0 <repeats 11 times>, 0x643ce4 "\201Ã\020s\f", 0x0, 0x0,
  0x70aff4 "<­p", 0xb77fc100 "\001\200­û`Â\177·`Â\177·`Â\177·`Â\177·tÂ\177·¯Â\177·`Â\177·¯Â\177·",
  0xb77fc0dc "ìÁ\177·6õc",
  0x644ff1 "\211~\020\213U\024\211~\f\211~\004\205Òt6\213U\024\213}ð\211V\024\211V\b1Ò\211~\030\211\226\230",
  0xb77fc100 "\001\200­û`Â\177·`Â\177·`Â\177·`Â\177·tÂ\177·¯Â\177·`Â\177·¯Â\177·",
  0xb77fc260 "\"Musicroom PÈÄ\177·\005", 0xb77fc2af "\b\001", 0x0, 0xb77fc2af "\b\001", 0x70aff4 "<­p",
  0x8106423 "\"%s\" <%s>", 0xb77fc21c "Ð\224\023\b\220Æ\027\b ", 0xb77fc1ec "\bÂ\177·\222tb",
  0x63f536 "\213\215\fÿÿÿ\211Â9\2150ÿÿÿt\t\213µ(ÿÿÿÆ\006",
  0xb77fc100 "\001\200­û`Â\177·`Â\177·`Â\177·`Â\177·tÂ\177·¯Â\177·`Â\177·¯Â\177·", 0x8106423 "\"%s\" <%s>",
  0xb77fc224 " ", 0xb77fc260 "\"Musicroom PÈÄ\177·\005", 0x0, 0xb77fc1a0 "$Èp",
  0xb77fc100 "\001\200­û`Â\177·`Â\177·`Â\177·`Â\177·tÂ\177·¯Â\177·`Â\177·¯Â\177·",
  0xfbad8001 <Address 0xfbad8001 out of bounds>, 0xb77fc260 "\"Musicroom PÈÄ\177·\005",
  0xb77fc260 "\"Musicroom PÈÄ\177·\005", 0xb77fc260 "\"Musicroom PÈÄ\177·\005",
  0xb77fc260 "\"Musicroom PÈÄ\177·\005", 0xb77fc274 "", 0xb77fc2af "\b\001",
  0xb77fc260 "\"Musicroom PÈÄ\177·\005", 0xb77fc2af "\b\001", 0x0 <repeats 12 times>, 0x645f91 "\201ÃcP\f",
  0x0, 0xffffffff <Address 0xffffffff out of bounds>, 0x0, 0x0, 0x0, 0x6ff38f "corrupted double-linked list",
  0x6ff38f "corrupted double-linked list", 0x6ff38f "corrupted double-linked list",
  0x6ff38f "corrupted double-linked list", 0x0, 0x0, 0x0, 0x0, 0x0, 0x18 <Address 0x18 out of bounds>,
  0x70aa20 "", 0x0, 0x0, 0x70c824 "", 0x70c828 "", 0x70c800 "", 0x0, 0x0, 0x0, 0x0, 0x70aff4 "<­p",
  0x70c800 "", 0x0, 0xb77fc28c "Ðç\031\b \230\234C.ð\016",
  0x647143 "éZþÿÿ\213\215\\ÿÿÿ9A\004ë\022\213\225\\ÿÿÿ\213r\b9F\004\211µ\\ÿÿÿwì\213\205\\ÿÿÿ\213p\fé\222þÿÿ\201}àÿ\001", 0x0, 0x0, 0x0, 0x0, 0x70aff4 "<­p", 0x0, 0xb77fcbb0 "°Ë\177·LÆ\027\b°Ë\177·\001",
  0xb77fc208 "ÈÄ\177·lÈ\n\bä¶\024\bÀ³\024\b\024",
  0x627492 "\203Ä\020[]Ã\220\220\220\220\220\220\220\220U\211å\215M\020S\203ì\f\213U\f\211L$\b\213E\bè¸'ýÿ\201Ã;;\016", 0xb77fc260 "\"Musicroom PÈÄ\177·\005", 0x50 <Address 0x50 out of bounds>, 0x8106423 "\"%s\" <%s>",
  0xb77fc21c "Ð\224\023\b\220Æ\027\b ", 0x814b010 "SIP/121-6faf", 0xb77fc4c8 "", 0x80ac86c "\213\204$À",
  0x814b6e4 "", 0x814b3c0 "", 0x14 <Address 0x14 out of bounds>, 0x81394d0 "Musicroom PC", 0x817c690 "121",
  0x20 <Address 0x20 out of bounds>, 0x70c800 "", 0xb77fc290 " \230\234C.ð\016",
  0x6ff3e1 "malloc(): memory corruption", 0x3 <Address 0x3 out of bounds>,
  0x814b418 "\"Musicroom PC\" <121>", 0x1 <Address 0x1 out of bounds>, 0x814b418 "\"Musicroom PC\" <121>",
  0x817c690 "121", 0x817c690 "121", 0x1 <Address 0x1 out of bounds>, 0x1 <Address 0x1 out of bounds>,
  0x810629a "<unknown>", 0x814b558 "SIP/121-6faf", 0x1 <Address 0x1 out of bounds>,
  0x73754d22 <Address 0x73754d22 out of bounds>, 0x6f726369 <Address 0x6f726369 out of bounds>,
  0x50206d6f <Address 0x50206d6f out of bounds>, 0xb77fc4c8 ""}
        passdata = "Sip|q", '\0' <repeats 8186 times>
        stacklen = 1
        tmp = '\0' <repeats 79 times>
        tmp2 = '\0' <repeats 79 times>
---Type <return> to continue, or q <return> to quit---
        tmp3 = '\0' <repeats 8191 times>
        atmp = '\0' <repeats 79 times>
        atmp2 = '\0' <repeats 8291 times>
        __PRETTY_FUNCTION__ = "pbx_extension_helper"
#6  0x0808ee44 in ast_spawn_extension (c=0x814b010, context=0x814b160 "default", exten=0x814b254 "178",
    priority=1, callerid=0x817c690 "121") at pbx.c:2220
No locals.
#7  0x0808f394 in __ast_pbx_run (c=0x814b010) at pbx.c:2286
        firstpass = 0
        digit = 0
        exten = '\0' <repeats 255 times>
        pos = 0
        waittime = 6579524
        res = 0
        autoloopflag = 0
        __PRETTY_FUNCTION__ = "__ast_pbx_run"
#8  0x08090295 in pbx_thread (data=0x814b010) at pbx.c:2507
        c = (struct ast_channel *) 0x814b010
#9  0x009ef341 in start_thread () from /lib/tls/libpthread.so.0
No symbol table info available.
#10 0x006abfee in clone () from /lib/tls/libc.so.6
No symbol table info available.

(gdb) thread apply all bt

Thread 15 (process 28992):
#0  0x00000293 in ?? ()
Cannot access memory at address 0x0
0x080624a5      999                     AST_LIST_INSERT_TAIL(&chan->spies->list, spy, list);