Index: apps/app_chanspy.c
===================================================================
--- apps/app_chanspy.c	(revision 114887)
+++ apps/app_chanspy.c	(working copy)
@@ -596,12 +596,15 @@
 
 	if (ast_test_flag(flags, OPTION_EXIT)) {
 		const char *c;
-		if ((c = pbx_builtin_getvar_helper(chan, "SPY_EXIT_CONTEXT")))
+		ast_channel_lock(chan);
+		if ((c = pbx_builtin_getvar_helper(chan, "SPY_EXIT_CONTEXT"))) {
 			ast_copy_string(exitcontext, c, sizeof(exitcontext));
+		}
 		else if (!ast_strlen_zero(chan->macrocontext))
 			ast_copy_string(exitcontext, chan->macrocontext, sizeof(exitcontext));
 		else
 			ast_copy_string(exitcontext, chan->context, sizeof(exitcontext));
+		ast_channel_unlock(chan);
 	}
 
 	ast_mutex_init(&chanspy_ds.lock);
Index: apps/app_stack.c
===================================================================
--- apps/app_stack.c	(revision 114887)
+++ apps/app_stack.c	(working copy)
@@ -351,8 +351,11 @@
 	frame = AST_LIST_FIRST(oldlist);
 	AST_LIST_TRAVERSE(&frame->varshead, variables, entries) {
 		if (!strcmp(data, ast_var_name(variables))) {
-			const char *tmp = pbx_builtin_getvar_helper(chan, data);
+			const char *tmp;
+			ast_channel_lock(chan);
+			tmp = pbx_builtin_getvar_helper(chan, data);
 			ast_copy_string(buf, S_OR(tmp, ""), len);
+			ast_channel_unlock(chan);
 			break;
 		}
 	}
Index: apps/app_meetme.c
===================================================================
--- apps/app_meetme.c	(revision 114887)
+++ apps/app_meetme.c	(working copy)
@@ -1575,12 +1575,22 @@
  					play_warning = warning_freq = 0;
  			}
  		}
- 			
- 		var = pbx_builtin_getvar_helper(chan, "CONF_LIMIT_WARNING_FILE");
+ 		
+		ast_channel_lock(chan);
+		if ((var = pbx_builtin_getvar_helper(chan, "CONF_LIMIT_WARNING_FILE"))) {
+			var = ast_strdupa(var);
+		}
+		ast_channel_unlock(chan);
+
  		warning_sound = var ? var : "timeleft";
  		
- 		var = pbx_builtin_getvar_helper(chan, "CONF_LIMIT_TIMEOUT_FILE");
- 		end_sound = var ? var : NULL;
+		ast_channel_lock(chan);
+		if ((var = pbx_builtin_getvar_helper(chan, "CONF_LIMIT_TIMEOUT_FILE"))) {
+			var = ast_strdupa(var);
+		}
+		ast_channel_unlock(chan);
+ 		
+		end_sound = var ? var : NULL;
  			
  		/* undo effect of S(x) in case they are both used */
  		calldurationlimit = 0;
@@ -1608,12 +1618,21 @@
 	
 	if (confflags & CONFFLAG_RECORDCONF) {
 		if (!conf->recordingfilename) {
-			conf->recordingfilename = pbx_builtin_getvar_helper(chan, "MEETME_RECORDINGFILE");
+			const char *var;
+			ast_channel_lock(chan);
+			if ((var = pbx_builtin_getvar_helper(chan, "MEETME_RECORDINGFILE"))) {
+				conf->recordingfilename = ast_strdupa(var);
+			}
+			ast_channel_unlock(chan);
 			if (!conf->recordingfilename) {
 				snprintf(recordingtmp, sizeof(recordingtmp), "meetme-conf-rec-%s-%s", conf->confno, chan->uniqueid);
 				conf->recordingfilename = ast_strdupa(recordingtmp);
 			}
-			conf->recordingformat = pbx_builtin_getvar_helper(chan, "MEETME_RECORDINGFORMAT");
+			ast_channel_lock(chan);
+			if ((var = pbx_builtin_getvar_helper(chan, "MEETME_RECORDINGFORMAT"))) {
+				conf->recordingformat = ast_strdupa(var);
+			}
+			ast_channel_unlock(chan);
 			if (!conf->recordingformat) {
 				ast_copy_string(recordingtmp, "wav", sizeof(recordingtmp));
 				conf->recordingformat = ast_strdupa(recordingtmp);
@@ -1736,12 +1755,15 @@
 	pbx_builtin_setvar_helper(chan, "MEETMEUNIQUEID", conf->uniqueid);
 
 	if (confflags & CONFFLAG_EXIT_CONTEXT) {
-		if ((agifile = pbx_builtin_getvar_helper(chan, "MEETME_EXIT_CONTEXT"))) 
+		ast_channel_lock(chan);
+		if ((agifile = pbx_builtin_getvar_helper(chan, "MEETME_EXIT_CONTEXT"))) {
 			ast_copy_string(exitcontext, agifile, sizeof(exitcontext));
+		}
 		else if (!ast_strlen_zero(chan->macrocontext)) 
 			ast_copy_string(exitcontext, chan->macrocontext, sizeof(exitcontext));
 		else
 			ast_copy_string(exitcontext, chan->context, sizeof(exitcontext));
+		ast_channel_unlock(chan);
 	}
 
 	if (!(confflags & (CONFFLAG_QUIET | CONFFLAG_NOONLYPERSON))) {
@@ -1931,11 +1953,16 @@
 	if (confflags & CONFFLAG_AGI) {
 		/* Get name of AGI file to run from $(MEETME_AGI_BACKGROUND)
 		   or use default filename of conf-background.agi */
-
-		agifile = pbx_builtin_getvar_helper(chan, "MEETME_AGI_BACKGROUND");
-		if (!agifile)
+		
+		ast_channel_lock(chan);
+		if ((agifile = pbx_builtin_getvar_helper(chan,"MEETME_AGI_BACKGROUND"))) {
+			agifile = ast_strdupa(agifile);
+		}
+		else {
 			agifile = agifiledefault;
-
+		}
+		ast_channel_unlock(chan);
+		
 		if (user->zapchannel) {
 			/*  Set CONFMUTE mode on Zap channel to mute DTMF tones */
 			x = 1;
Index: apps/app_morsecode.c
===================================================================
--- apps/app_morsecode.c	(revision 114887)
+++ apps/app_morsecode.c	(working copy)
@@ -111,16 +111,20 @@
 	}
 
 	/* Use variable MORESEDITLEN, if set (else 80) */
+	ast_channel_lock(chan);
 	ditlenc = pbx_builtin_getvar_helper(chan, "MORSEDITLEN");
 	if (ast_strlen_zero(ditlenc) || (sscanf(ditlenc, "%d", &ditlen) != 1)) {
 		ditlen = 80;
 	}
+	ast_channel_unlock(chan);
 
 	/* Use variable MORSETONE, if set (else 800) */
+	ast_channel_lock(chan);
 	tonec = pbx_builtin_getvar_helper(chan, "MORSETONE");
 	if (ast_strlen_zero(tonec) || (sscanf(tonec, "%d", &tone) != 1)) {
 		tone = 800;
 	}
+	ast_channel_unlock(chan);
 
 	for (digit = data; *digit; digit++) {
 		int digit2 = *digit;
Index: apps/app_minivm.c
===================================================================
--- apps/app_minivm.c	(revision 114887)
+++ apps/app_minivm.c	(working copy)
@@ -1412,7 +1412,12 @@
 
 
 	/* Read counter if available */
-	counter = pbx_builtin_getvar_helper(chan, "MVM_COUNTER");
+	ast_channel_lock(chan);
+	if ((counter = pbx_builtin_getvar_helper(chan, "MVM_COUNTER"))) {
+		counter = ast_strdupa(counter);
+	}
+	ast_channel_unlock(chan);
+
 	if (ast_strlen_zero(counter)) {
 		ast_debug(2, "-_-_- MVM_COUNTER not found\n");
 	} else {
@@ -1659,14 +1664,24 @@
 		pbx_builtin_setvar_helper(chan, "MINIVM_NOTIFY_STATUS", "FAILED");
 		return -1;
 	}
-	
-	filename = pbx_builtin_getvar_helper(chan, "MVM_FILENAME");
-	format = pbx_builtin_getvar_helper(chan, "MVM_FORMAT");
-	duration_string = pbx_builtin_getvar_helper(chan, "MVM_DURATION");
+
+	ast_channel_lock(chan);	
+	if ((filename = pbx_builtin_getvar_helper(chan, "MVM_FILENAME"))) {
+		filename = ast_strdupa(filename);
+	}
+	ast_channel_unlock(chan);
 	/* Notify of new message to e-mail and pager */
 	if (!ast_strlen_zero(filename)) {
+		ast_channel_lock(chan);	
+		if ((format = pbx_builtin_getvar_helper(chan, "MVM_FORMAT"))) {
+			format = ast_strdupa(format);
+		}
+		if ((duration_string = pbx_builtin_getvar_helper(chan, "MVM_DURATION"))) {
+			duration_string = ast_strdupa(duration_string);
+		}
+		ast_channel_unlock(chan);
 		res = notify_new_message(chan, template, vmu, filename, atoi(duration_string), format, chan->cid.cid_num, chan->cid.cid_name);
-	};
+	}
 
 	pbx_builtin_setvar_helper(chan, "MINIVM_NOTIFY_STATUS", res == 0 ? "SUCCESS" : "FAILED");
 
@@ -1928,10 +1943,14 @@
 	int res = 0;
 	char filename[BUFSIZ];
 		
-	if (!ast_strlen_zero(data))
+	if (!ast_strlen_zero(data)) {
 		ast_copy_string(filename, (char *) data, sizeof(filename));
-	else
+	}
+	else {
+		ast_channel_lock(chan);
 		ast_copy_string(filename, pbx_builtin_getvar_helper(chan, "MVM_FILENAME"), sizeof(filename));
+		ast_channel_unlock(chan);
+	}
 
 	if (ast_strlen_zero(filename)) {
 		ast_log(LOG_ERROR, "No filename given in application arguments or channel variable MVM_FILENAME\n");
Index: apps/app_macro.c
===================================================================
--- apps/app_macro.c	(revision 114887)
+++ apps/app_macro.c	(working copy)
@@ -165,20 +165,28 @@
 	}
 
 	/* does the user want a deeper rabbit hole? */
-	s = pbx_builtin_getvar_helper(chan, "MACRO_RECURSION");
-	if (s)
+	ast_channel_lock(chan);
+	if ((s = pbx_builtin_getvar_helper(chan, "MACRO_RECURSION"))) {
 		sscanf(s, "%d", &maxdepth);
-
+	}
+	ast_channel_unlock(chan);
+	
 	/* Count how many levels deep the rabbit hole goes */
-	s = pbx_builtin_getvar_helper(chan, "MACRO_DEPTH");
-	if (s)
+	ast_channel_lock(chan);
+	if ((s = pbx_builtin_getvar_helper(chan, "MACRO_DEPTH"))) {
 		sscanf(s, "%d", &depth);
+	}
+	ast_channel_unlock(chan);
+	
 	/* Used for detecting whether to return when a Macro is called from another Macro after hangup */
 	if (strcmp(chan->exten, "h") == 0)
 		pbx_builtin_setvar_helper(chan, "MACRO_IN_HANGUP", "1");
-	inhangupc = pbx_builtin_getvar_helper(chan, "MACRO_IN_HANGUP");
-	if (!ast_strlen_zero(inhangupc))
+	
+	ast_channel_lock(chan);
+	if ((inhangupc = pbx_builtin_getvar_helper(chan, "MACRO_IN_HANGUP"))) {
 		sscanf(inhangupc, "%d", &inhangup);
+	}
+	ast_channel_unlock(chan);
 
 	if (depth >= maxdepth) {
 		ast_log(LOG_ERROR, "Macro():  possible infinite loop detected.  Returning early.\n");
@@ -252,9 +260,11 @@
   		/* Save copy of old arguments if we're overwriting some, otherwise
 	   	let them pass through to the other macro */
   		snprintf(varname, sizeof(varname), "ARG%d", argc);
-		s = pbx_builtin_getvar_helper(chan, varname);
-		if (s)
+		ast_channel_lock(chan);
+		if ((s = pbx_builtin_getvar_helper(chan, varname))) {
 			oldargs[argc] = ast_strdup(s);
+		}
+		ast_channel_unlock(chan);
 		pbx_builtin_setvar_helper(chan, varname, cur);
 		argc++;
 	}
@@ -431,6 +441,7 @@
 			/* Copy the extension, so long as we're not in softhangup, where we could be given an asyncgoto */
 			const char *offsets;
 			ast_copy_string(chan->exten, oldexten, sizeof(chan->exten));
+			ast_channel_lock(chan);
 			if ((offsets = pbx_builtin_getvar_helper(chan, "MACRO_OFFSET"))) {
 				/* Handle macro offset if it's set by checking the availability of step n + offset + 1, otherwise continue
 			   	normally if there is any problem */
@@ -440,6 +451,7 @@
 					}
 				}
 			}
+			ast_channel_unlock(chan);
 		}
 	}
 
Index: apps/app_voicemail.c
===================================================================
--- apps/app_voicemail.c	(revision 114887)
+++ apps/app_voicemail.c	(working copy)
@@ -3522,7 +3522,11 @@
 	if (tmpptr)
 		*tmpptr++ = '\0';
 
-	category = pbx_builtin_getvar_helper(chan, "VM_CATEGORY");
+	ast_channel_lock(chan);
+	if ((category = pbx_builtin_getvar_helper(chan, "VM_CATEGORY"))) {
+		category = ast_strdupa(category);
+	}
+	ast_channel_unlock(chan);
 
 	ast_debug(3, "Before find_user\n");
 	if (!(vmu = find_user(&svm, context, ext))) {
@@ -4741,9 +4745,15 @@
 {
 	char todir[PATH_MAX], fn[PATH_MAX], ext_context[PATH_MAX], *stringp;
 	int newmsgs = 0, oldmsgs = 0;
-	const char *category = pbx_builtin_getvar_helper(chan, "VM_CATEGORY");
+	const char *category;
 	char *myserveremail = serveremail;
 
+	ast_channel_lock(chan);
+	if ((category = pbx_builtin_getvar_helper(chan, "VM_CATEGORY"))) {
+		category = ast_strdupa(category);
+	}
+	ast_channel_unlock(chan);
+
 	make_dir(todir, sizeof(todir), vmu->context, vmu->mailbox, "INBOX");
 	make_file(fn, sizeof(fn), todir, msgnum);
 	snprintf(ext_context, sizeof(ext_context), "%s@%s", vmu->mailbox, vmu->context);
Index: apps/app_speech_utils.c
===================================================================
--- apps/app_speech_utils.c	(revision 114887)
+++ apps/app_speech_utils.c	(working copy)
@@ -559,9 +559,13 @@
 	}
 
 	/* See if the maximum DTMF length variable is set... we use a variable in case they want to carry it through their entire dialplan */
-	if ((tmp2 = pbx_builtin_getvar_helper(chan, "SPEECH_DTMF_MAXLEN")) && !ast_strlen_zero(tmp2))
-		max_dtmf_len = atoi(tmp2);
-
+	ast_channel_lock(chan);
+	if ((tmp2 = pbx_builtin_getvar_helper(chan, "SPEECH_DTMF_MAXLEN"))) {
+		if(!ast_strlen_zero(tmp2)) {
+			max_dtmf_len = atoi(tmp2);
+		}
+	}
+	
 	/* See if a terminator is specified */
 	if ((tmp2 = pbx_builtin_getvar_helper(chan, "SPEECH_DTMF_TERMINATOR"))) {
 		if (ast_strlen_zero(tmp2))
@@ -569,6 +573,7 @@
 		else
 			dtmf_terminator = tmp2[0];
 	}
+	ast_channel_unlock(chan);
 
 	/* Before we go into waiting for stuff... make sure the structure is ready, if not - start it again */
 	if (speech->state == AST_SPEECH_STATE_NOT_READY || speech->state == AST_SPEECH_STATE_DONE) {
Index: apps/app_zapscan.c
===================================================================
--- apps/app_zapscan.c	(revision 114887)
+++ apps/app_zapscan.c	(working copy)
@@ -324,8 +324,10 @@
 
 		if (tempchan && search_group) {
 			const char *mygroup;
+			ast_channel_lock(tempchan);
 			if ((mygroup = pbx_builtin_getvar_helper(tempchan, "GROUP")) && (!strcmp(mygroup, desired_group))) {
 				ast_verb(3, "Found Matching Channel %s in group %s\n", tempchan->name, desired_group);
+				ast_channel_unlock(tempchan);
 			} else {
 				ast_channel_unlock(tempchan);
 				lastchan = tempchan;
Index: apps/app_externalivr.c
===================================================================
--- apps/app_externalivr.c	(revision 114887)
+++ apps/app_externalivr.c	(working copy)
@@ -251,9 +251,15 @@
 			break;
 		}
 		
-		value = pbx_builtin_getvar_helper(chan, variable);
-		if(!value)
+		ast_channel_lock(chan);
+		if ((value = pbx_builtin_getvar_helper(chan, variable))) {
+			value = ast_strdupa(value);
+		}
+		else {
 			value = "";
+		}
+		ast_channel_unlock(chan);
+
 		ast_str_append(&newstring, 0, "%s=%s,", variable, value);
 		ast_copy_string(outbuf, newstring->str, outbuflen);
 	}
Index: apps/app_while.c
===================================================================
--- apps/app_while.c	(revision 114887)
+++ apps/app_while.c	(working copy)
@@ -184,22 +184,22 @@
 	memset(my_name, 0, size);
 	snprintf(my_name, size, "%s_%s_%d", chan->context, chan->exten, chan->priority);
 	
-	if (ast_strlen_zero(label)) {
-		if (end) 
-			label = used_index;
-		else if (!(label = pbx_builtin_getvar_helper(chan, my_name))) {
-			label = new_index;
-			pbx_builtin_setvar_helper(chan, my_name, label);
-		}
-		
+	ast_channel_lock(chan);
+	if (end) {
+		label = used_index;
 	}
-	
+	else if (!(label = pbx_builtin_getvar_helper(chan, my_name))) {
+		label = new_index;
+		pbx_builtin_setvar_helper(chan, my_name, label);
+	}
+	ast_channel_unlock(chan);
 	snprintf(varname, VAR_SIZE, "%s_%s", prefix, label);
-	while_pri = pbx_builtin_getvar_helper(chan, varname);
-	
+	ast_channel_lock(chan);
 	if ((while_pri = pbx_builtin_getvar_helper(chan, varname)) && !end) {
+		while_pri = ast_strdupa(while_pri);
 		snprintf(end_varname,VAR_SIZE,"END_%s",varname);
 	}
+	ast_channel_unlock(chan);
 	
 
 	if ((!end && !pbx_checkcondition(condition)) || (end == 2)) {
@@ -208,7 +208,10 @@
 		pbx_builtin_setvar_helper(chan, varname, NULL);
 		pbx_builtin_setvar_helper(chan, my_name, NULL);
 		snprintf(end_varname,VAR_SIZE,"END_%s",varname);
-		if ((goto_str=pbx_builtin_getvar_helper(chan, end_varname))) {
+		ast_channel_lock(chan);
+		if ((goto_str = pbx_builtin_getvar_helper(chan, end_varname))) {
+			goto_str = ast_strdupa(goto_str);
+			ast_channel_unlock(chan);
 			ast_parseable_goto(chan, goto_str);
 			pbx_builtin_setvar_helper(chan, end_varname, NULL);
 		} else {
@@ -219,6 +222,7 @@
 			} else {
 				ast_log(LOG_WARNING, "Couldn't find matching EndWhile? (While at %s@%s priority %d)\n", chan->context, chan->exten, chan->priority);
 			}
+			ast_channel_unlock(chan);
 		}
 		return res;
 	}
@@ -231,7 +235,6 @@
 		snprintf(goto_str, size, "%s,%s,%d", chan->context, chan->exten, chan->priority);
 		pbx_builtin_setvar_helper(chan, varname, goto_str);
 	} 
-
 	else if (end && while_pri) {
 		/* END of loop */
 		snprintf(end_varname, VAR_SIZE, "END_%s", varname);
