From 859cbd75e12966b09985b2a992da5ffb250938f8 Mon Sep 17 00:00:00 2001
From: Ondrej Zajicek <santiago@crfreenet.org>
Date: Mon, 14 Apr 2014 12:50:03 +0200
Subject: [PATCH 1/3] Fixes a bug in (mainly) IPv6 BGP.

Stack variable may be used unitialized and that would lead to spurious
rta_free(), which may cause crash. The bug was introduced in 1.4.1 from
merging add-path branch.

Thanks to Peter Andreev for reporting it and Alexander V. Chernikov for
resolving it.
---
 proto/bgp/packets.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 808afaa9..b6239025 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -1082,7 +1082,7 @@ bgp_do_rx_update(struct bgp_conn *conn,
 {
   struct bgp_proto *p = conn->bgp;
   struct rte_src *src = p->p.main_source;
-  rta *a0, *a;
+  rta *a0, *a = NULL;
   ip_addr prefix;
   int pxlen, err = 0;
   u32 path_id = 0;
@@ -1115,7 +1115,6 @@ bgp_do_rx_update(struct bgp_conn *conn,
   if (a0 && ! bgp_set_next_hop(p, a0))
     a0 = NULL;
 
-  a = NULL;
   last_id = 0;
   src = p->p.main_source;
 
@@ -1187,7 +1186,7 @@ bgp_do_rx_update(struct bgp_conn *conn,
   byte *start, *x;
   int len, len0;
   unsigned af, sub;
-  rta *a0, *a;
+  rta *a0, *a = NULL;
   ip_addr prefix;
   int pxlen, err = 0;
   u32 path_id = 0;
@@ -1234,7 +1233,6 @@ bgp_do_rx_update(struct bgp_conn *conn,
       if (a0 && ! bgp_set_next_hop(p, a0))
 	a0 = NULL;
 
-      a = NULL;
       last_id = 0;
       src = p->p.main_source;
 

From 7c4a8007255403d046d7e909f710f0b1ed1791b1 Mon Sep 17 00:00:00 2001
From: Ondrej Filip <feela@network.cz>
Date: Mon, 14 Apr 2014 12:28:30 +0200
Subject: [PATCH 2/3] Fixed bug in unused function.

---
 lib/mempool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/mempool.c b/lib/mempool.c
index 65072f9a..ec9854a9 100644
--- a/lib/mempool.c
+++ b/lib/mempool.c
@@ -250,7 +250,7 @@ lp_memsize(resource *r)
     cnt++;
 
   return ALLOC_OVERHEAD + sizeof(struct linpool) +
-    cnt * (ALLOC_OVERHEAD + sizeof(sizeof(struct lp_chunk))) +
+    cnt * (ALLOC_OVERHEAD + sizeof(struct lp_chunk)) +
     m->total + m->total_large;
 }
 

From 6c6ebd64c3e44a2658a7ae8729159f1653c00a89 Mon Sep 17 00:00:00 2001
From: Ondrej Zajicek <santiago@crfreenet.org>
Date: Mon, 14 Apr 2014 14:47:20 +0200
Subject: [PATCH 3/3] NEWS and version update.

---
 NEWS            | 3 +++
 misc/bird.spec  | 2 +-
 sysdep/config.h | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index 614cc7e4..4fe259aa 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,6 @@
+Version 1.4.3 (2014-04-14)
+  o Important bugfix in IPv6 BGP.
+
 Version 1.4.2 (2014-04-02)
   o Important bugfix in BFD.
 
diff --git a/misc/bird.spec b/misc/bird.spec
index 69f2dc78..0c730982 100644
--- a/misc/bird.spec
+++ b/misc/bird.spec
@@ -1,6 +1,6 @@
 Summary: BIRD Internet Routing Daemon
 Name: bird
-Version: 1.4.2
+Version: 1.4.3
 Release: 1
 Copyright: GPL
 Group: Networking/Daemons
diff --git a/sysdep/config.h b/sysdep/config.h
index b4aa7528..e2ea7642 100644
--- a/sysdep/config.h
+++ b/sysdep/config.h
@@ -7,7 +7,7 @@
 #define _BIRD_CONFIG_H_
 
 /* BIRD version */
-#define BIRD_VERSION "1.4.2"
+#define BIRD_VERSION "1.4.3"
 
 /* Include parameters determined by configure script */
 #include "sysdep/autoconf.h"