Index: channels/chan_sip.c
===================================================================
--- channels/chan_sip.c	(revision 396920)
+++ channels/chan_sip.c	(working copy)
@@ -26004,7 +26004,13 @@
 			p->invitestate = INV_TERMINATED;
 			p->pendinginvite = 0;
 			acked = __sip_ack(p, seqno, 1 /* response */, 0);
-			if (find_sdp(req)) {
+			if (!p->owner) {
+				/*
+				 * This call is being destroyed already (a
+				 * hangup somewhere). Don't do anything that
+				 * touches p->owner.
+				 */
+			} else if (find_sdp(req)) {
 				if (process_sdp(p, req, SDP_T38_NONE)) {
 					return -1;
 				}