It's possible for sub->owner to be NULL here if you cancel the call immediately after/during sending a digit.

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.4@76174 65c4cc65-6c06-0410-ace0-fbb531ad65f3

channels/chan_skinny.c

@@ -4160,7 +4160,7 @@ static int handle_message(struct skinny_req *req, struct skinnysession *s)
 
 		sub = find_subchannel_by_instance_reference(d, lineInstance, callReference);
 
-		if (sub && (sub->owner->_state <  AST_STATE_UP)) {
+		if (sub && (sub->owner && sub->owner->_state <  AST_STATE_UP)) {
 			char dgt;
 			int digit = letohl(req->data.keypad.button);
 			size_t len;