It's possible for sub->owner to be NULL here if you cancel the call immediately after...

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@76174 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_skinny.c b/channels/chan_skinny.c
index 4571c62dd00b70deb5c4c4d81686266b35644602..82f01b70d3e6716fd98eede7dbff2f2cd2a0d113 100644 (file)
--- a/channels/chan_skinny.c
+++ b/channels/chan_skinny.c
@@ -4160,7 +4160,7 @@ static int handle_message(struct skinny_req *req, struct skinnysession *s)
 
                sub = find_subchannel_by_instance_reference(d, lineInstance, callReference);
 
-               if (sub && (sub->owner->_state <  AST_STATE_UP)) {
+               if (sub && (sub->owner && sub->owner->_state <  AST_STATE_UP)) {
                        char dgt;
                        int digit = letohl(req->data.keypad.button);
                        size_t len;