Park call crashes Asterisk 1.2.8

Over the last week I have seen several crashes on Asterisk and they all occurred after somebody was parked. Very similar to the situation describe by this link lists.digium.com/pipermail/aster … 20509.html

At first I thought it is the MOH (mpg123) but after disabling it I am still experiencing the crashes. It will happens just after the 7 0 1 has been read back to the personwho parked the call and the moment he/she hangsup it crashes Asterisk. I have no clue what can be causing it, any help would be appreciated.

Here is the top part of the back trace:

– Started music on hold, class ‘default’, on channel ‘Zap/1-1’
– Playing ‘pbx-transfer’ (language ‘en’)
– Stopped music on hold on Zap/1-1
– Started music on hold, class ‘default’, on channel ‘Zap/1-1’
== Parked Zap/1-1 on 701. Will timeout back to extension [support-direct] s, 9 in 240 seconds
– Added extension ‘701’ priority 1 to parkedcalls
– Playing ‘digits/7’ (language ‘en’)
– Playing ‘digits/0’ (language ‘en’)
– Playing ‘digits/1’ (language ‘en’)
– Starting simple switch on ‘Zap/3-1’
== Spawn extension (support-direct, s, 9) exited non-zero on ‘Zap/1-1’
– Stopped music on hold on Zap/1-1
– Hungup ‘Zap/1-1’
== x\uffff\uffffX> got tired of being parked
Aug 15 09:39:06 WARNING[31743]: chan_zap.c:2313 zt_hangup: Asked to hangup channel not connected
Aug 15 09:39:06 WARNING[31743]: channel.c:903 ast_channel_free: Unable to find channel in list
*** glibc detected *** asterisk: double free or corruption (fasttop): 0x08c0e838 ***
======= Backtrace: =========
/lib/libc.so.6[0x321424]
/lib/libc.so.6(__libc_free+0x77)[0x32195f]
asterisk(ast_channel_free+0x1e8)[0x8063548]

Ok I have narrowed the problem down a bit more. It seems that it only crashes Asterisk when you try and park a call from a queue. I can park a call that came directly to my extension without a problem but the moment an Agent parks a call from the queue, Asterisk crashes.

But wait there is more. This is even more bizarre. I have written a Switchboard application and I can park a call from there by using the ParkAndAnnounce application. Well if I am an agent in the queue and I use the software (ParkAndAnounce) to park the call rather than the phone, Asterisk doesn’t crashes. I have no idea what ParkAndAnnounce does with the channel but it sure is different from the channel that is in the queue.

Can anybody else confirm this behavior? I just recently upgraded from 1.25 to 1.28 and 1.25 didn’t behaved like that.