==16054== Memcheck, a memory error detector.
==16054== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==16054== Using LibVEX rev 1658, a library for dynamic binary translation.
==16054== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==16054== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==16054== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==16054== For more details, rerun with: -v
==16054== 
==16054== My PID = 16054, parent PID = 25655.  Prog and args are:
==16054==    asterisk
==16054==    -vvvvcg
==16054== 
==16054== Invalid read of size 1
==16054==    at 0x2C944D: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054==  Address 0x4E5A1B4 is 516 bytes inside a block of size 653 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x2C8FF2: _dl_close_worker (in /lib/ld-2.5.so)
==16054==    by 0x2C9476: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Invalid read of size 4
==16054==    at 0x2C9456: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054==  Address 0x4E5A138 is 392 bytes inside a block of size 653 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x2C8FF2: _dl_close_worker (in /lib/ld-2.5.so)
==16054==    by 0x2C9476: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Invalid read of size 4
==16054==    at 0x2C948D: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054==  Address 0x4E59FB4 is 4 bytes inside a block of size 653 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x2C8FF2: _dl_close_worker (in /lib/ld-2.5.so)
==16054==    by 0x2C9476: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Invalid read of size 1
==16054==    at 0x4006258: strlen (mc_replace_strmem.c:247)
==16054==    by 0x2C3F31: _dl_signal_error (in /lib/ld-2.5.so)
==16054==    by 0x2C94A2: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054==  Address 0x4E59F50 is 0 bytes inside a block of size 45 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x2C8F70: _dl_close_worker (in /lib/ld-2.5.so)
==16054==    by 0x2C9476: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Invalid read of size 1
==16054==    at 0x4006263: strlen (mc_replace_strmem.c:247)
==16054==    by 0x2C3F31: _dl_signal_error (in /lib/ld-2.5.so)
==16054==    by 0x2C94A2: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054==  Address 0x4E59F51 is 1 bytes inside a block of size 45 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x2C8F70: _dl_close_worker (in /lib/ld-2.5.so)
==16054==    by 0x2C9476: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Invalid read of size 1
==16054==    at 0x2CBD65: memcpy (in /lib/ld-2.5.so)
==16054==    by 0x2C94A2: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054==  Address 0x4E59F50 is 0 bytes inside a block of size 45 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x2C8F70: _dl_close_worker (in /lib/ld-2.5.so)
==16054==    by 0x2C9476: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Invalid read of size 4
==16054==    at 0x2CBD6C: memcpy (in /lib/ld-2.5.so)
==16054==    by 0x2C94A2: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054==  Address 0x4E59F51 is 1 bytes inside a block of size 45 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x2C8F70: _dl_close_worker (in /lib/ld-2.5.so)
==16054==    by 0x2C9476: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Invalid read of size 2
==16054==    at 0x2CBD6A: memcpy (in /lib/ld-2.5.so)
==16054==    by 0x2C94A2: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054==  Address 0x4E5A620 is 0 bytes inside a block of size 38 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x2C8F70: _dl_close_worker (in /lib/ld-2.5.so)
==16054==    by 0x2C9476: _dl_close (in /lib/ld-2.5.so)
==16054==    by 0x2D4CE3: dlclose_doit (in /lib/libdl-2.5.so)
==16054==    by 0x2C3E35: _dl_catch_error (in /lib/ld-2.5.so)
==16054==    by 0x2D52CB: _dlerror_run (in /lib/libdl-2.5.so)
==16054==    by 0x2D4D19: dlclose (in /lib/libdl-2.5.so)
==16054==    by 0x80DE689: load_dynamic_module (loader.c:401)
==16054==    by 0x80DF1AD: load_resource (loader.c:663)
==16054==    by 0x80DFB5F: load_modules (loader.c:878)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Source and destination overlap in memcpy(0xBEAAF1EC, 0xBEAAF28C, 428)
==16054==    at 0x4006CA6: memcpy (mc_replace_strmem.c:116)
==16054==    by 0x5A8987C: Decode (iLBC_decode.c:254)
==16054==    by 0x5A8A31A: iLBC_decode (iLBC_decode.c:508)
==16054==    by 0x5A88E6A: ilbctolin_framein (codec_ilbc.c:108)
==16054==    by 0x8146D15: framein (translate.c:193)
==16054==    by 0x81478DC: calc_cost (translate.c:420)
==16054==    by 0x81488A5: __ast_register_translator (translate.c:672)
==16054==    by 0x5A8913F: load_module (codec_ilbc.c:200)
==16054==    by 0x80DF2E6: load_resource (loader.c:694)
==16054==    by 0x80DFCC1: load_modules (loader.c:898)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Source and destination overlap in memcpy(0xBEAAF1EC, 0xBEAAF28C, 428)
==16054==    at 0x4006CA6: memcpy (mc_replace_strmem.c:116)
==16054==    by 0x5A89A35: Decode (iLBC_decode.c:302)
==16054==    by 0x5A8A31A: iLBC_decode (iLBC_decode.c:508)
==16054==    by 0x5A88E6A: ilbctolin_framein (codec_ilbc.c:108)
==16054==    by 0x8146D15: framein (translate.c:193)
==16054==    by 0x81478DC: calc_cost (translate.c:420)
==16054==    by 0x81488A5: __ast_register_translator (translate.c:672)
==16054==    by 0x5A8913F: load_module (codec_ilbc.c:200)
==16054==    by 0x80DF2E6: load_resource (loader.c:694)
==16054==    by 0x80DFCC1: load_modules (loader.c:898)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Source and destination overlap in memcpy(0xBEAAF9F0, 0xBEAAFA90, 428)
==16054==    at 0x4006CA6: memcpy (mc_replace_strmem.c:116)
==16054==    by 0x5A8B494: iLBC_encode (iLBC_encode.c:311)
==16054==    by 0x5A89026: lintoilbc_frameout (codec_ilbc.c:148)
==16054==    by 0x814791B: calc_cost (translate.c:422)
==16054==    by 0x81488A5: __ast_register_translator (translate.c:672)
==16054==    by 0x5A89162: load_module (codec_ilbc.c:202)
==16054==    by 0x80DF2E6: load_resource (loader.c:694)
==16054==    by 0x80DFCC1: load_modules (loader.c:898)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Conditional jump or move depends on uninitialised value(s)
==16054==    at 0x66B092C: speex_decode_int (speex.c:167)
==16054==    by 0x669A327: speextolin_framein (codec_speex.c:196)
==16054==    by 0x8146D15: framein (translate.c:193)
==16054==    by 0x81478DC: calc_cost (translate.c:420)
==16054==    by 0x81488A5: __ast_register_translator (translate.c:672)
==16054==    by 0x669B935: load_module (codec_speex.c:458)
==16054==    by 0x80DF2E6: load_resource (loader.c:694)
==16054==    by 0x80DFCC1: load_modules (loader.c:898)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Conditional jump or move depends on uninitialised value(s)
==16054==    at 0x66B0935: speex_decode_int (speex.c:169)
==16054==    by 0x669A327: speextolin_framein (codec_speex.c:196)
==16054==    by 0x8146D15: framein (translate.c:193)
==16054==    by 0x81478DC: calc_cost (translate.c:420)
==16054==    by 0x81488A5: __ast_register_translator (translate.c:672)
==16054==    by 0x669B935: load_module (codec_speex.c:458)
==16054==    by 0x80DF2E6: load_resource (loader.c:694)
==16054==    by 0x80DFCC1: load_modules (loader.c:898)
==16054==    by 0x807E13F: main (asterisk.c:3586)
==16054== 
==16054== Thread 26:
==16054== Syscall param socketcall.sendto(msg) points to unaddressable byte(s)
==16054==    at 0x461FB8: sendto (in /lib/libc-2.5.so)
==16054==    by 0x687E9DE: retrans_pkt (chan_sip.c:3445)
==16054==    by 0x813A0A2: ast_sched_runq (sched.c:631)
==16054==    by 0x68D3F52: do_monitor (chan_sip.c:21285)
==16054==    by 0x814E3DD: dummy_start (utils.c:968)
==16054==    by 0x30845A: start_thread (in /lib/libpthread-2.5.so)
==16054==    by 0x460E5D: clone (in /lib/libc-2.5.so)
==16054==  Address 0x678B50C is 140 bytes inside a block of size 877 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x807E827: __ast_free_region (astmm.c:192)
==16054==    by 0x807EBD1: __ast_free (astmm.c:226)
==16054==    by 0x687F55E: __sip_reliable_xmit (chan_sip.c:3585)
==16054==    by 0x6880AE5: send_request (chan_sip.c:3863)
==16054==    by 0x689F381: transmit_notify_with_mwi (chan_sip.c:10432)
==16054==    by 0x68D38D9: sip_send_mwi_to_peer (chan_sip.c:21146)
==16054==    by 0x68DEF66: build_peer (chan_sip.c:22912)
==16054==    by 0x68E4053: reload_config (chan_sip.c:23705)
==16054==    by 0x68E7AC0: load_module (chan_sip.c:24506)
==16054==    by 0x80DF2E6: load_resource (loader.c:694)
==16054==    by 0x80DFCC1: load_modules (loader.c:898)
==16054== 
==16054== Thread 29:
==16054== Invalid write of size 1
==16054==    at 0x81402B2: __ast_str_helper2 (strings.c:128)
==16054==    by 0x814DA33: ast_str_append_substr (strings.h:736)
==16054==    by 0x5E171B5: WriteMemoryCallback (func_curl.c:359)
==16054==    by 0x5C3FC53: Curl_client_write (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5C56A2A: Curl_httpchunk_read (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5C54ABB: Curl_readwrite (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5C55BBD: Curl_perform (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5C55FC8: curl_easy_perform (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5E17698: acf_curl_exec (func_curl.c:456)
==16054==    by 0x80F8EF6: ast_func_read (pbx.c:3316)
==16054==    by 0x80F9437: pbx_substitute_variables_helper_full (pbx.c:3451)
==16054==    by 0x80F99DB: pbx_substitute_variables_helper (pbx.c:3546)
==16054==  Address 0x4991944 is 156 bytes inside a block of size 160 free'd
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x807E827: __ast_free_region (astmm.c:192)
==16054==    by 0x807ED10: __ast_realloc (astmm.c:247)
==16054==    by 0x814D8A9: _ast_str_make_space (strings.h:493)
==16054==    by 0x8140323: __ast_str_helper2 (strings.c:135)
==16054==    by 0x814DA33: ast_str_append_substr (strings.h:736)
==16054==    by 0x5E171B5: WriteMemoryCallback (func_curl.c:359)
==16054==    by 0x5C3FC53: Curl_client_write (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5C56A2A: Curl_httpchunk_read (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5C54ABB: Curl_readwrite (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5C55BBD: Curl_perform (in /usr/lib/libcurl.so.3.0.0)
==16054==    by 0x5C55FC8: curl_easy_perform (in /usr/lib/libcurl.so.3.0.0)
==16054== 
==16054== Thread 30:
==16054== Invalid read of size 4
==16054==    at 0x808E44C: ast_check_hangup (channel.c:462)
==16054==    by 0x8083AF2: autoservice_run (autoservice.c:95)
==16054==    by 0x814E3DD: dummy_start (utils.c:968)
==16054==    by 0x30845A: start_thread (in /lib/libpthread-2.5.so)
==16054==    by 0x460E5D: clone (in /lib/libc-2.5.so)
==16054==  Address 0x22286807 is not stack'd, malloc'd or (recently) free'd
==16054== 
==16054== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==16054==  Access not within mapped region at address 0x22286807
==16054==    at 0x808E44C: ast_check_hangup (channel.c:462)
==16054==    by 0x8083AF2: autoservice_run (autoservice.c:95)
==16054==    by 0x814E3DD: dummy_start (utils.c:968)
==16054==    by 0x30845A: start_thread (in /lib/libpthread-2.5.so)
==16054==    by 0x460E5D: clone (in /lib/libc-2.5.so)
--16054-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--16054-- si_code=1;  Faulting address: 0x6E652B22;  sp: 0x650EC680

valgrind: the 'impossible' happened:
   Killed by fatal signal
==16054==    at 0x3801FBD9: mkFreeBlock (m_mallocfree.c:189)
==16054==    by 0x3801FF40: vgPlain_arena_free (m_mallocfree.c:1127)
==16054==    by 0x38036054: vgPlain_cli_free (replacemalloc_core.c:108)
==16054==    by 0x3800199F: die_and_free_mem (mc_malloc_wrappers.c:111)
==16054==    by 0x380367D2: do_client_request (scheduler.c:1158)
==16054==    by 0x3803810C: vgPlain_scheduler (scheduler.c:869)
==16054==    by 0x3801DC8F: shutdown_actions_NORETURN (m_main.c:2782)
==16054==    by 0x3805728D: run_a_thread_NORETURN (syswrap-linux.c:139)
==16054==    by 0x3805736A: vgModuleLocal_start_thread_NORETURN (syswrap-linux.c:207)
==16054==    by 0x38059638: (within /usr/lib/valgrind/x86-linux/memcheck)

sched status:
  running_tid=9

Thread 9: status = VgTs_Runnable
==16054==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==16054==    by 0x45F88E: tdestroy (in /lib/libc-2.5.so)
==16054==    by 0x49F98A: free_mem (in /lib/libc-2.5.so)
==16054==    by 0x49F6E6: __libc_freeres (in /lib/libc-2.5.so)
==16054==    by 0x40011E6: _vgnU_freeres (vg_preloaded.c:60)
==16054==    by 0x420B05: (within /lib/libc-2.5.so)
==16054==    by 0x814E3DD: dummy_start (utils.c:968)
==16054==    by 0x30845A: start_thread (in /lib/libpthread-2.5.so)
==16054==    by 0x460E5D: clone (in /lib/libc-2.5.so)


Note: see also the FAQ.txt in the source distribution.
It contains workarounds to several common problems.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what Linux distro you are using.  Thanks.