Sipp 3 and 2 occassionally crash dereferencing a play_args_t structure that has been freed by the control thread aborting the call. There is not currently any signalling used to tear down the pcap thread when the call aborts, and so the play_args_t is freed out from under the running thread.
This patch avoids the crash by changing the play_args_t struct inside the call class to a pointer allocated by malloc(). If the thread is successfully started, then the thread routine (send_wrapper()) is responsible for freeing the play_args_t. If the thread is not successfully started, then the freeing is done by the caller.
Problem verified, and fix validated with valgrind on Linux.