Core was generated by `/usr/sbin/asterisk -f -C /etc/asterisk12/asterisk.conf -vvvg -c'.
Program terminated with signal 11, Segmentation fault.
#0  0x000000000055b63e in __ast_str_helper (buf=0x7fe8805fafc6, max_len=0, append=1, fmt=0x7feb4336a1b3 "%s", ap=0x7fea967bee90) at strings.c:60
60		int offset = (append && (*buf)->__AST_STR_LEN) ? (*buf)->__AST_STR_USED : 0;
Missing separate debuginfos, use: debuginfo-install cyrus-sasl-lib-2.1.23-8.el6.x86_64 glibc-2.12-1.25.el6_1.3.x86_64 keyutils-libs-1.4-1.el6.x86_64 krb5-libs-1.9-9.el6_1.1.x86_64 libcom_err-1.41.12-7.el6.x86_64 libcurl-7.19.7-26.el6_1.2.x86_64 libgcc-4.4.5-6.el6.x86_64 libidn-1.18-2.el6.x86_64 libselinux-2.0.94-5.el6.x86_64 libssh2-1.2.2-7.el6.x86_64 libstdc++-4.4.5-6.el6.x86_64 libtool-ltdl-2.2.6-15.5.el6.x86_64 libxml2-2.7.6-1.el6.x86_64 ncurses-libs-5.7-3.20090208.el6.x86_64 nspr-4.8.7-1.el6.x86_64 nss-3.12.9-9.el6.x86_64 nss-softokn-freebl-3.12.9-3.el6.x86_64 nss-util-3.12.9-1.el6.x86_64 openldap-2.4.23-15.el6_1.1.x86_64 openssl-1.0.0-10.el6_1.4.x86_64 sqlite-3.6.20-1.el6.x86_64 unixODBC-2.2.14-11.el6.x86_64 zlib-1.2.3-26.el6.x86_64
(gdb) bt
#0  0x000000000055b63e in __ast_str_helper (buf=0x7fe8805fafc6, max_len=0, append=1, fmt=0x7feb4336a1b3 "%s", ap=0x7fea967bee90) at strings.c:60
#1  0x000000000056cd71 in ast_str_append_va (buf=0x7fe8805fafc6, max_len=0, fmt=0x7feb4336a1b3 "%s", ap=0x7fea967bee90)
    at /usr/src/asterisk/include/asterisk/strings.h:787
#2  0x000000000056d04e in ast_str_append (buf=0x7fe8805fafc6, max_len=0, fmt=0x7feb4336a1b3 "%s") at /usr/src/asterisk/include/asterisk/strings.h:859
#3  0x00007feb433678d5 in strreplace (chan=0x7fe8805fafe5, cmd=0x7fe8805fafe4 "", data=0x7fe8805fafe3 "", buf=0x7fe8805fafc6, len=140636562894789)
    at func_strings.c:936
#4  0x00000000005110cf in ast_func_read (chan=0x7feb1c3ad8d8, function=0x7fea967c0160 "STRREPLACE(CARRIERLIST,8888,6106)", workspace=0x7fea967bf150 "", len=4096)
    at pbx.c:3680
#5  0x000000000051230c in pbx_substitute_variables_helper_full (c=0x7feb1c3ad8d8, headp=0x7feb1c3add08, 
    cp1=0x7fe880856980 "CARRIERLIST=${STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})}", cp2=0x7fea967c448c "", count=8179, used=0x7fea967c22c8) at pbx.c:4054
#6  0x0000000000512874 in pbx_substitute_variables_helper (c=0x7feb1c3ad8d8, cp1=0x7fe880856980 "CARRIERLIST=${STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})}", 
    cp2=0x7fea967c4480 "CARRIERLIST=", count=8191) at pbx.c:4150
#7  0x0000000000512983 in pbx_substitute_variables (passdata=0x7fea967c4480 "CARRIERLIST=", datalen=8192, c=0x7feb1c3ad8d8, e=0x7fe881bf8750) at pbx.c:4175
#8  0x0000000000512bfa in pbx_extension_helper (c=0x7feb1c3ad8d8, con=0x0, context=0x7feb1c3ae1a8 "defaultproc", exten=0x7feb1c3ae1f8 "18188886106", priority=10, 
    label=0x0, callerid=0x7fe880f7d560 "5034571000", action=E_SPAWN, found=0x7fea967c6b70, combined_find_spawn=1) at pbx.c:4237
#9  0x0000000000514c10 in ast_spawn_extension (c=0x7feb1c3ad8d8, context=0x7feb1c3ae1a8 "defaultproc", exten=0x7feb1c3ae1f8 "18188886106", priority=10, 
    callerid=0x7fe880f7d560 "5034571000", found=0x7fea967c6b70, combined_find_spawn=1) at pbx.c:4911
#10 0x000000000051565b in __ast_pbx_run (c=0x7feb1c3ad8d8, args=0x0) at pbx.c:5009
#11 0x00000000005172dd in pbx_thread (data=0x7feb1c3ad8d8) at pbx.c:5344
#12 0x000000000056dbdd in dummy_start (data=0x7feb1cf67bf0) at utils.c:1010
#13 0x0000003c080077e1 in start_thread () from /lib64/libpthread.so.0
#14 0x0000003c074e577d in clone () from /lib64/libc.so.6
(gdb) bt full
#0  0x000000000055b63e in __ast_str_helper (buf=0x7fe8805fafc6, max_len=0, append=1, fmt=0x7feb4336a1b3 "%s", ap=0x7fea967bee90) at strings.c:60
        res = -1770262696
        need = 32746
        offset = -1770262656
        aq = {{gp_offset = 7, fp_offset = 0, overflow_arg_area = 0x511eb9, reg_save_area = 0x967bf094}}
        __PRETTY_FUNCTION__ = "__ast_str_helper"
#1  0x000000000056cd71 in ast_str_append_va (buf=0x7fe8805fafc6, max_len=0, fmt=0x7feb4336a1b3 "%s", ap=0x7fea967bee90)
    at /usr/src/asterisk/include/asterisk/strings.h:787
No locals.
#2  0x000000000056d04e in ast_str_append (buf=0x7fe8805fafc6, max_len=0, fmt=0x7feb4336a1b3 "%s") at /usr/src/asterisk/include/asterisk/strings.h:859
        res = 32746
        ap = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fea967bef80, reg_save_area = 0x7fea967beeb0}}
#3  0x00007feb433678d5 in strreplace (chan=0x7fe8805fafe5, cmd=0x7fe8805fafe4 "", data=0x7fe8805fafe3 "", buf=0x7fe8805fafc6, len=140636562894789)
    at func_strings.c:936
        starts = 0x7fea967befa0
        varsubstr = 0x7fea967bef80 "${CARRIERLIST}"
        count_len = 10
        p = 0x7fe8805fafa8 "SIP/g729.216.234.77.102/81"
        find_size = 4
        max_matches = 68
        x = 0
        str = 0x7fe8805faf90
        args = {argc = 2153754598, argv = 0x7fea967befe0, varname = 0x7fe8805fafe7 "", find_string = 0x7fea967bf097 "8888", replace_string = 0x7fea967bf09c "6106", 
---Type <return> to continue, or q <return> to quit---
          max_replacements = 0x0}
        __PRETTY_FUNCTION__ = "strreplace"
#4  0x00000000005110cf in ast_func_read (chan=0x7feb1c3ad8d8, function=0x7fea967c0160 "STRREPLACE(CARRIERLIST,8888,6106)", workspace=0x7fea967bf150 "", len=4096)
    at pbx.c:3680
        str = 0x7fe881cc8e90
        copy = 0x7fea967bf080 "STRREPLACE"
        args = 0x7fea967bf08b "CARRIERLIST"
        acfptr = 0x7feb4356b9a0
        res = 32746
        u = 0x7fe880d2dc40
        __PRETTY_FUNCTION__ = "ast_func_read"
#5  0x000000000051230c in pbx_substitute_variables_helper_full (c=0x7feb1c3ad8d8, headp=0x7feb1c3add08, 
    cp1=0x7fe880856980 "CARRIERLIST=${STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})}", cp2=0x7fea967c448c "", count=8179, used=0x7fea967c22c8) at pbx.c:4054
        cp4 = 0x0
        tmp = 0x7fe880856980 "CARRIERLIST=${STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})}"
        whereweare = 0x7fe8808569c0 ""
        orig_cp2 = 0x7fea967c4480 "CARRIERLIST="
        length = 0
        offset = 0
        offset2 = 2147483647
        isfunction = 1
        workspace = 0x7fea967bf150 ""
        ltmp = 0x7fea967c0160 "STRREPLACE(CARRIERLIST,8888,6106)"
---Type <return> to continue, or q <return> to quit---
        var = 0x7fea967c1170 "STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})"
        nextvar = 0x7fe88085698c "${STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})}"
        nextexp = 0x0
        nextthing = 0x7fe88085698c "${STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})}"
        vars = 0x7fea967c0160 "STRREPLACE(CARRIERLIST,8888,6106)"
        vare = 0x7fe8808569c0 ""
        pos = 12
        brackets = 0
        needsub = 2
        len = 49
        __PRETTY_FUNCTION__ = "pbx_substitute_variables_helper_full"
#6  0x0000000000512874 in pbx_substitute_variables_helper (c=0x7feb1c3ad8d8, cp1=0x7fe880856980 "CARRIERLIST=${STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})}", 
    cp2=0x7fea967c4480 "CARRIERLIST=", count=8191) at pbx.c:4150
        used = 140648368510608
#7  0x0000000000512983 in pbx_substitute_variables (passdata=0x7fea967c4480 "CARRIERLIST=", datalen=8192, c=0x7feb1c3ad8d8, e=0x7fe881bf8750) at pbx.c:4175
        tmp = 0x7fe88085698c "${STRREPLACE(CARRIERLIST,${OLDEXTEN},${EXTEN:7:10})}"
#8  0x0000000000512bfa in pbx_extension_helper (c=0x7feb1c3ad8d8, con=0x0, context=0x7feb1c3ae1a8 "defaultproc", exten=0x7feb1c3ae1f8 "18188886106", priority=10, 
    label=0x0, callerid=0x7fe880f7d560 "5034571000", action=E_SPAWN, found=0x7fea967c6b70, combined_find_spawn=1) at pbx.c:4237
        e = 0x7fe881bf8750
        app = 0x2104da0
        res = 472038032
        q = {incstack = {0x0 <repeats 128 times>}, stacklen = 0, status = 5, swo = 0x0, data = 0x0, foundcontext = 0x7feb1c3ae1a8 "defaultproc"}
        passdata = "CARRIERLIST=\000LIST,Z,NANI,CLIST,PLIST,PROMPT,TO,OLDEXTEN)=SIP/g729.216.234.77.102/8188888888-SIP/g729.69.30.55.34/18188888888-,2,5034571000,a383b1---Type <return> to continue, or q <return> to quit---
818888c0.008640d0.008640e0f18188888888x0,g96h1818888_i0"...
        matching_action = 0
        __PRETTY_FUNCTION__ = "pbx_extension_helper"
#9  0x0000000000514c10 in ast_spawn_extension (c=0x7feb1c3ad8d8, context=0x7feb1c3ae1a8 "defaultproc", exten=0x7feb1c3ae1f8 "18188886106", priority=10, 
    callerid=0x7fe880f7d560 "5034571000", found=0x7fea967c6b70, combined_find_spawn=1) at pbx.c:4911
No locals.
#10 0x000000000051565b in __ast_pbx_run (c=0x7feb1c3ad8d8, args=0x0) at pbx.c:5009
        digit = 0
        invalid = 0
        timeout = 0
        dst_exten = '\000' <repeats 32 times>"\330, \377\377\377\377\377\377\377\001\000\000\000\000\000\000\000\340\377\377\377\377\377\377\377\001\000\000\000\000\000\000\000\350\377\377\377\377\377\377\377\001\000\000\000\000\000\000\000\360\377\377\377\377\377\377\377\001\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\001", '\000' <repeats 31 times>, "@\001\000\000\000\000\000\000\a", '\000' <repeats 15 times>, "\001\000\000\000\000\000\000\000\210y\000\b<", '\000' <repeats 11 times>"\370, \377\377\377\377\377\377\377\001\000\000\000\000\000\000\000\020\000\000\000\000\000\000\000\033\377\001", '\000' <repeats 13 times>, " m|\226\352\177\000\000\320k|\226\352\177\000\000\020m|\226\352\177\000\000p}|\226\352\177\000"
        pos = 0
        found = 1
        res = 0
        autoloopflag = 0
        error = 0
        __PRETTY_FUNCTION__ = "__ast_pbx_run"
#11 0x00000000005172dd in pbx_thread (data=0x7feb1c3ad8d8) at pbx.c:5344
        c = 0x7feb1c3ad8d8
---Type <return> to continue, or q <return> to quit---
#12 0x000000000056dbdd in dummy_start (data=0x7feb1cf67bf0) at utils.c:1010
        __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {0, 7129750256961510468, 140648368510608, 140645523814848, 4, 7, 7129750256953121860, 
                -7123328742052537276}, __mask_was_saved = 0}}, __pad = {0x7fea967c6e90, 0x0, 0x7fea967c7a10, 0x0}}
        __cancel_routine = 0x437c95 <ast_unregister_thread>
        __cancel_arg = 0x7fea967c7700
        not_first_call = 0
        ret = 0x3c07785858
        a = {start_routine = 0x5172b8 <pbx_thread>, data = 0x7feb1c3ad8d8, 
          name = 0x7feb1d3f7c20 "pbx_thread", ' ' <repeats 11 times>, "started at [ 5370] pbx.c ast_pbx_start()"}
#13 0x0000003c080077e1 in start_thread () from /lib64/libpthread.so.0
No symbol table info available.
#14 0x0000003c074e577d in clone () from /lib64/libc.so.6
No symbol table info available.