diff -u -r asterisk-1.8.10.0/main/channel.c asterisk-1.8.10.0-patched/main/channel.c
--- asterisk-1.8.10.0/main/channel.c	2012-02-28 12:53:34.000000000 -0500
+++ asterisk-1.8.10.0-patched/main/channel.c	2012-03-29 13:27:27.000000000 -0400
@@ -1406,6 +1406,13 @@
 	unsigned int queued_voice_frames = 0;
 	AST_LIST_HEAD_NOLOCK(, ast_frame) frames;
 
+	if (fin->frametype == AST_FRAME_MODEM &&
+            fin->datalen && !fin->data.ptr) {
+		ast_log(LOG_ERROR, "__ast_queue_frame() MODEM Frame Datalen %i while data ptr is NULL\n", fin->datalen);
+		return -1;
+	}		 
+
+
 	ast_channel_lock(chan);
 
 	/*
@@ -3923,6 +3930,14 @@
 		struct ast_frame *readq_tail = AST_LIST_LAST(&chan->readq);
 		struct ast_control_read_action_payload *read_action_payload;
 		struct ast_party_connected_line connected;
+	
+		if (f->frametype == AST_FRAME_MODEM &&
+		    f->datalen && !f->data.ptr) {
+			ast_log(LOG_ERROR, "__ast_read() MODEM Frame Datalen %i while data ptr is NULL\n", f->datalen);
+			ast_frfree(f);
+			f = &ast_null_frame;
+			goto done;
+		}		 
 
 		/* if the channel driver returned more than one frame, stuff the excess
 		   into the readq for the next ast_read call
diff -u -r asterisk-1.8.10.0/main/frame.c asterisk-1.8.10.0-patched/main/frame.c
--- asterisk-1.8.10.0/main/frame.c	2010-06-17 13:23:43.000000000 -0400
+++ asterisk-1.8.10.0-patched/main/frame.c	2012-03-20 15:48:01.000000000 -0400
@@ -506,6 +506,10 @@
 		AST_LIST_TRAVERSE_SAFE_END;
 	}
 #endif
+	if (f->datalen && !f->data.ptr) {
+		ast_log(LOG_ERROR, "ast_fdup() Datalen %i while data ptr is NULL\n", f->datalen);
+		return NULL;
+	}
 
 	if (!buf) {
 		if (!(buf = ast_calloc_cache(1, len)))
diff -u -r asterisk-1.8.10.0/main/udptl.c asterisk-1.8.10.0-patched/main/udptl.c
--- asterisk-1.8.10.0/main/udptl.c	2011-10-06 13:49:38.000000000 -0400
+++ asterisk-1.8.10.0-patched/main/udptl.c	2012-03-20 10:44:35.000000000 -0400
@@ -1071,6 +1071,7 @@
 			"You may need to override the T38FaxMaxDatagram value for this endpoint in the channel driver configuration.\n",
 			LOG_TAG(s), len, s->far_max_ifp);
 		len = s->far_max_ifp;
+		return -1;
 	}
 
 	/* Save seq_no for debug output because udptl_build_packet increments it */