It is possible for span-input to get call with sw_if_index which is not in sm->interfaces and crashes in span_mirror () in the following line

  span_interface_t *si0 = vec_elt_at_index (sm->interfaces, sw_if_index0);

For example, span-input mirrors main interface as source, it may actually get call for traffic coming in from the subinterface and crashes.