From 3e168e58f6cef4c06e7e6c76b50e824360816570 Mon Sep 17 00:00:00 2001
From: claudio <claudio@openbsd.org>
Date: Thu, 24 Jun 2021 10:04:05 +0000
Subject: [PATCH] aspath_deflate() did free the passed in data but since the
 way aspaths are processed in the Adj-RIB-Out this is no longer needed since
 the passed in pointer is still referenced and is not allowed to be freed.
 Adjust the mrt code similar to how up_generate_attr() uses aspath_deflate().
 OK sthen@

---
 usr.sbin/bgpd/mrt.c      | 12 ++++++++----
 usr.sbin/bgpd/rde_attr.c |  4 +---
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/usr.sbin/bgpd/mrt.c b/usr.sbin/bgpd/mrt.c
index c7c39ba7e4f..41a9bd6079f 100644
--- a/usr.sbin/bgpd/mrt.c
+++ b/usr.sbin/bgpd/mrt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mrt.c,v 1.103 2020/01/09 11:55:25 claudio Exp $ */
+/*	$OpenBSD: mrt.c,v 1.104 2021/06/24 10:04:05 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Claudio Jeker <claudio@openbsd.org>
@@ -160,15 +160,19 @@ mrt_attr_dump(struct ibuf *buf, struct rde_aspath *a, struct rde_community *c,
 		return (-1);
 
 	/* aspath */
-	pdata = aspath_prepend(a->aspath, rde_local_as(), 0, &plen);
+	plen = aspath_length(a->aspath);
+	pdata = aspath_dump(a->aspath);
+
 	if (!v2)
 		pdata = aspath_deflate(pdata, &plen, &neednewpath);
 	if (attr_writebuf(buf, ATTR_WELL_KNOWN, ATTR_ASPATH, pdata,
 	    plen) == -1) {
-		free(pdata);
+		if (!v2)
+			free(pdata);
 		return (-1);
 	}
-	free(pdata);
+	if (!v2)
+		free(pdata);
 
 	if (nexthop && nexthop->aid == AID_INET) {
 		/* nexthop, already network byte order */
diff --git a/usr.sbin/bgpd/rde_attr.c b/usr.sbin/bgpd/rde_attr.c
index 69d8ee0da1f..2402aae4903 100644
--- a/usr.sbin/bgpd/rde_attr.c
+++ b/usr.sbin/bgpd/rde_attr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde_attr.c,v 1.124 2021/01/16 13:14:54 claudio Exp $ */
+/*	$OpenBSD: rde_attr.c,v 1.125 2021/06/24 10:04:05 claudio Exp $ */
 
 /*
  * Copyright (c) 2004 Claudio Jeker <claudio@openbsd.org>
@@ -568,7 +568,6 @@ aspath_put(struct aspath *aspath)
 
 /*
  * convert a 4 byte aspath to a 2 byte one.
- * data is freed by aspath_deflate
  */
 u_char *
 aspath_deflate(u_char *data, u_int16_t *len, int *flagnew)
@@ -614,7 +613,6 @@ aspath_deflate(u_char *data, u_int16_t *len, int *flagnew)
 		}
 	}
 
-	free(data);
 	*len = nlen;
 	return (ndata);
 }
-- 
2.20.1