Hello, My dial plan contains something like the following: <action application="bridge" data="sofia/profile1/$1,sofia/profile2/$1"/> This causes a problem in mod_dialplan_xml.c, near line 150: len = (uint32_t) (strlen(data) + strlen(field_data) + 10); if (!(substituted = malloc(len))) { switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_CRIT, "memory error!\n"); proceed = 0; goto done; } memset(substituted, 0, len); switch_perform_substitution(re, proceed, data, field_data, substituted, len, ovector); app_data = substituted; The problem is simple: len is too small because the $1 pattern appears twice. Therefore adding strlen(field_data) once is not enough. It should be multiplied by the number of times the pattern appears in the string. It seems like someone experienced the same problem before: that would explain the "+ 10" magic number which I am very tempted to just increase to 100. ;-) Is this really a bug or is it my imagination? If it is a bug, how should we go about fixing it? Thanks, Simon -- Please try Numb, a STUN/TURN server implementation. Free access at http://numb.viagenie.ca/.