If a drouting module is performing routing through a GW configured with a zero length prefix, opensips will crash:
line 1422 in drouting.c will set val.s.len to -1 which will lead to a crash while creating the new AVP.
Thanks for report - the fix is on trunk and 1.8. Please confirm it and if so, close the ticket.
Tested ok (no more crashes).