Hey! When filtering routes in BGP, I get the following crash with BIRD master: #v+ Program received signal SIGSEGV, Segmentation fault. 0x000055555558ccdd in rta_free (r=0x55555558adc0 <rte_get_temp+16>) at ../nest/route.h:643 643 static inline void rta_free(rta *r) { if (r && !--r->uc) rta__free(r); } gdb$ bt full #0 0x000055555558ccdd in rta_free (r=0x55555558adc0 <rte_get_temp+16>) at ../nest/route.h:643 No locals. #1 rte_update2 (c=0x5555555f3de0, n=0x7fffffffe2f0, n@entry=0x7fffffffe260, new=<optimized out>, src=0x5555555fec00) at ../nest/rt-table.c:1589 old_attrs = 0x55555558adc0 <rte_get_temp+16> fr = <optimized out> p = <optimized out> stats = 0x5555555f3e78 filter = 0x5555555ed980 dummy = 0x0 nn = 0x7fffffffe210 #2 0x000055555559ca0a in rte_update3 (src=<optimized out>, new=<optimized out>, n=<optimized out>, c=<optimized out>) at ../nest/protocol.h:628 No locals. #3 bgp_rte_update (s=s@entry=0x7fffffffe350, n=n@entry=0x7fffffffe2f0, path_id=path_id@entry=4294959812, a0=a0@entry=0x0) at ../proto/bgp/packets.c:1267 a = <optimized out> e = <optimized out> #4 0x000055555559d6dd in bgp_decode_nlri_ip6 (s=0x7fffffffe350, pos=<optimized out>, len=<optimized out>, a=0x0) at ../proto/bgp/packets.c:1500 net = {type = 2 '\002', pxlen = 48 '0', length = 20, prefix = {addr = {536939960, 3722248192, 0, 0}}} path_id = 4294959812 l = 48 addr = {addr = {3087860000, 56797, 0, 0}} b = <optimized out> #5 0x000055555559aced in bgp_decode_nlri (s=s@entry=0x7fffffffe460, afi=<optimized out>, nlri=0x5555556034d0 "0 \001\r\270\335\335\060 \001\r\270\314\314@\001\001", len=14, ea=ea@entry=0x5555556065f0, nh=<optimized out>, nh_len=32) at ../proto/bgp/packets.c:2351 c = 0x5555555f3de0 a = 0x7fffffffe350 #6 0x000055555559ed64 in bgp_rx_update (conn=conn@entry=0x5555555f3cd8, pkt=pkt@entry=0x555555603490 '\377' <repeats 16 times>, len=91) at ../proto/bgp/packets.c:2448 p = <optimized out> ea = 0x5555556065f0 s = {proto = 0x5555555f3ad0, channel = 0x5555555f3de0, pool = 0x5555556019c0, as4_session = 1, add_path = 0, mpls = 0, attrs_seen = {16390, 0, 0, 0, 0, 0, 0, 0}, mp_reach_af = 131073, mp_unreach_af = 0, attr_len = 68, ip_reach_len = 0, ip_unreach_len = 0, ip_next_hop_len = 0, mp_reach_len = 14, mp_unreach_len = 0, mp_next_hop_len = 32, attrs = 0x5555556034a7 "\220\016", ip_reach_nlri = 0x5555556034eb '\377' <repeats 16 times>, ip_unreach_nlri = 0x5555556034a5 "", ip_next_hop_data = 0x0, mp_reach_nlri = 0x5555556034d0 "0 \001\r\270\335\335\060 \001\r\270\314\314@\001\001", mp_unreach_nlri = 0x0, mp_next_hop_data = 0x5555556034af " \001\r\270\252\252", err_withdraw = 0, err_subcode = 0, err_jmpbuf = {{__jmpbuf = {93824992885456, -942560477419964727, 93824992949408, 93824992885976, 0, 93824992949392, 942560477161682633, 6359628643728717513}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}, hostentry = 0x0, mpls_labels = 0x0, last_id = 0, last_src = 0x5555555fec00, cached_rta = 0x5555556075c8} pos = <optimized out> #7 0x000055555559fadb in bgp_rx_packet (len=<optimized out>, pkt=0x555555603490 '\377' <repeats 16 times>, conn=0x5555555f3cd8) at ../proto/bgp/packets.c:3024 type = 2 '\002' type = <optimized out> #8 bgp_rx (sk=0x555555601bb0, size=<optimized out>) at ../proto/bgp/packets.c:3069 conn = 0x5555555f3cd8 pkt_start = 0x555555603490 '\377' <repeats 16 times> end = 0x555555603508 "" i = <optimized out> len = <optimized out> #9 0x00005555555a48da in call_rx_hook (s=0x555555601bb0, size=<optimized out>) at ../sysdep/unix/io.c:1794 No locals. #10 0x00005555555a6db7 in sk_read (s=s@entry=0x555555601bb0, revents=1) at ../sysdep/unix/io.c:1882 c = <optimized out> #11 0x00005555555a781e in io_loop () at ../sysdep/unix/io.c:2344 s = <optimized out> count = 1 poll_tout = <optimized out> timeout = <optimized out> nfds = <optimized out> events = <optimized out> pout = <optimized out> t = <optimized out> s = <optimized out> n = <optimized out> fdmax = 256 pfd = 0x555555601010 #12 0x0000555555560f53 in main (argc=<optimized out>, argv=<optimized out>) at ../sysdep/unix/main.c:906 use_uid = <optimized out> use_gid = <optimized out> conf = 0x5555555eca10 #v- Minimal configuration is: #v+ log "/var/log/bird.log" all; router id 2.2.2.2; filter validated { reject; } protocol device { } protocol bgp { local as 65001; neighbor 2001:db8:aaaa::0 as 65000; ipv6 { import filter validated; export none; }; } #v- I have tried to fix that by initializing `old_attrs` to NULL, but this leads to crash elsewhere. Since I don't know what a temporary attribute is, I may miss the whole picture. -- Don't diddle code to make it faster - find a better algorithm. - The Elements of Programming Style (Kernighan & Plauger)