Index: pjproject/trunk/pjsip/src/pjsip/sip_transport_tcp.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_transport_tcp.c	(revision 1816)
+++ pjproject/trunk/pjsip/src/pjsip/sip_transport_tcp.c	(revision 1817)
@@ -104,5 +104,11 @@
     pjsip_transport	     base;
     pj_bool_t		     is_server;
+
+    /* Do not save listener instance in the transport, because
+     * listener might be destroyed during transport's lifetime.
+     * See http://trac.pjsip.org/repos/ticket/491
     struct tcp_listener	    *listener;
+     */
+
     pj_bool_t		     is_registered;
     pj_bool_t		     is_closing;
@@ -525,5 +531,5 @@
     tcp->sock = sock;
     tcp->is_server = is_server;
-    tcp->listener = listener;
+    /*tcp->listener = listener;*/
     pj_list_init(&tcp->delayed_list);
     tcp->base.pool = pool;
@@ -674,5 +680,5 @@
     /* Stop keep-alive timer. */
     if (tcp->ka_timer.id) {
-	pjsip_endpt_cancel_timer(tcp->listener->endpt, &tcp->ka_timer);
+	pjsip_endpt_cancel_timer(tcp->base.endpt, &tcp->ka_timer);
 	tcp->ka_timer.id = PJ_FALSE;
     }
@@ -757,5 +763,5 @@
 
     /* Init rdata */
-    pool = pjsip_endpt_create_pool(tcp->listener->endpt,
+    pool = pjsip_endpt_create_pool(tcp->base.endpt,
 				   "rtd%p",
 				   PJSIP_POOL_RDATA_LEN,
@@ -1195,5 +1201,5 @@
     /* Stop keep-alive timer. */
     if (tcp->ka_timer.id) {
-	pjsip_endpt_cancel_timer(tcp->listener->endpt, &tcp->ka_timer);
+	pjsip_endpt_cancel_timer(tcp->base.endpt, &tcp->ka_timer);
 	tcp->ka_timer.id = PJ_FALSE;
     }
@@ -1435,5 +1441,5 @@
     if (PJSIP_TCP_KEEP_ALIVE_INTERVAL) {
 	pj_time_val delay = { PJSIP_TCP_KEEP_ALIVE_INTERVAL, 0 };
-	pjsip_endpt_schedule_timer(tcp->listener->endpt, &tcp->ka_timer, 
+	pjsip_endpt_schedule_timer(tcp->base.endpt, &tcp->ka_timer, 
 				   &delay);
 	tcp->ka_timer.id = PJ_TRUE;
@@ -1463,5 +1469,5 @@
 	delay.msec = 0;
 
-	pjsip_endpt_schedule_timer(tcp->listener->endpt, &tcp->ka_timer, 
+	pjsip_endpt_schedule_timer(tcp->base.endpt, &tcp->ka_timer, 
 				   &delay);
 	tcp->ka_timer.id = PJ_TRUE;
@@ -1490,5 +1496,5 @@
     delay.msec = 0;
 
-    pjsip_endpt_schedule_timer(tcp->listener->endpt, &tcp->ka_timer, 
+    pjsip_endpt_schedule_timer(tcp->base.endpt, &tcp->ka_timer, 
 			       &delay);
     tcp->ka_timer.id = PJ_TRUE;
Index: pjproject/trunk/pjsip/src/pjsip/sip_transport_tls_ossl.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_transport_tls_ossl.c	(revision 1816)
+++ pjproject/trunk/pjsip/src/pjsip/sip_transport_tls_ossl.c	(revision 1817)
@@ -156,5 +156,16 @@
     pjsip_transport	     base;
     pj_bool_t		     is_server;
+
+    /* Do not save listener instance in the transport, because
+     * listener might be destroyed during transport's lifetime.
+     * See http://trac.pjsip.org/repos/ticket/491
     struct tls_listener	    *listener;
+     */
+
+    /* TLS settings, copied from listener */
+    struct {
+	pj_time_val	     timeout;
+    } setting;
+
     pj_bool_t		     is_registered;
     pj_bool_t		     is_closing;
@@ -591,10 +602,10 @@
 	    PJ_TODO(SUPPORT_SSL_ASYNCHRONOUS_CONNECT);
 
-	    if (tls->listener->setting.timeout.sec == 0 &&
-		tls->listener->setting.timeout.msec == 0)
+	    if (tls->setting.timeout.sec == 0 &&
+		tls->setting.timeout.msec == 0)
 	    {
 		p_timeout = NULL;
 	    } else {
-		timeout = tls->listener->setting.timeout;
+		timeout = tls->setting.timeout;
 		p_timeout = &timeout;
 	    }
@@ -723,10 +734,10 @@
 	    pj_assert(PJ_FD_COUNT(&rd_set) == 1 || PJ_FD_COUNT(&wr_set) == 1);
 
-	    if (tls->listener->setting.timeout.sec == 0 &&
-		tls->listener->setting.timeout.msec == 0)
+	    if (tls->setting.timeout.sec == 0 &&
+		tls->setting.timeout.msec == 0)
 	    {
 		p_timeout = NULL;
 	    } else {
-		timeout = tls->listener->setting.timeout;
+		timeout = tls->setting.timeout;
 		p_timeout = &timeout;
 	    }
@@ -1217,7 +1228,8 @@
     tls->sock = sock;
     tls->is_server = is_server;
-    tls->listener = listener;
+    /*tls->listener = listener;*/
     pj_list_init(&tls->delayed_list);
     tls->base.pool = pool;
+    tls->setting.timeout = listener->setting.timeout;
 
     pj_ansi_snprintf(tls->base.obj_name, PJ_MAX_OBJ_NAME, 
@@ -1404,5 +1416,5 @@
     /* Stop keep-alive timer. */
     if (tls->ka_timer.id) {
-	pjsip_endpt_cancel_timer(tls->listener->endpt, &tls->ka_timer);
+	pjsip_endpt_cancel_timer(tls->base.endpt, &tls->ka_timer);
 	tls->ka_timer.id = PJ_FALSE;
     }
@@ -1492,5 +1504,5 @@
 
     /* Init rdata */
-    pool = pjsip_endpt_create_pool(tls->listener->endpt,
+    pool = pjsip_endpt_create_pool(tls->base.endpt,
 				   "rtd%p",
 				   PJSIP_POOL_RDATA_LEN,
@@ -1974,5 +1986,5 @@
 	/* Stop keep-alive timer. */
 	if (tls->ka_timer.id) {
-	    pjsip_endpt_cancel_timer(tls->listener->endpt, &tls->ka_timer);
+	    pjsip_endpt_cancel_timer(tls->base.endpt, &tls->ka_timer);
 	    tls->ka_timer.id = PJ_FALSE;
 	}
@@ -2278,5 +2290,5 @@
     if (PJSIP_TLS_KEEP_ALIVE_INTERVAL) {
 	pj_time_val delay = { PJSIP_TLS_KEEP_ALIVE_INTERVAL, 0 };
-	pjsip_endpt_schedule_timer(tls->listener->endpt, &tls->ka_timer, 
+	pjsip_endpt_schedule_timer(tls->base.endpt, &tls->ka_timer, 
 				   &delay);
 	tls->ka_timer.id = PJ_TRUE;
@@ -2308,5 +2320,5 @@
 	delay.msec = 0;
 
-	pjsip_endpt_schedule_timer(tls->listener->endpt, &tls->ka_timer, 
+	pjsip_endpt_schedule_timer(tls->base.endpt, &tls->ka_timer, 
 				   &delay);
 	tls->ka_timer.id = PJ_TRUE;
@@ -2334,5 +2346,5 @@
     delay.msec = 0;
 
-    pjsip_endpt_schedule_timer(tls->listener->endpt, &tls->ka_timer, 
+    pjsip_endpt_schedule_timer(tls->base.endpt, &tls->ka_timer, 
 			       &delay);
     tls->ka_timer.id = PJ_TRUE;
