diff --git a/debian/patches/series b/debian/patches/series
index da7fd3372..e03c2d8f5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,6 +1,8 @@
 ##
 # upstream fixes
 # 4.4
+upstream/0001-lcr-fixed-checking-if-there-is-more-uris-available-f.patch
+upstream/0002-tmx-allocate-space-to-store-ending-0-for-branch-valu.patch
 # upsream fixes from master
 upstream/pv-new-function-pv_evalx-dst-fmt.patch
 upstream/pv_trans_cfg_line.patch
diff --git a/debian/patches/upstream/0001-lcr-fixed-checking-if-there-is-more-uris-available-f.patch b/debian/patches/upstream/0001-lcr-fixed-checking-if-there-is-more-uris-available-f.patch
new file mode 100644
index 000000000..8a4785bd8
--- /dev/null
+++ b/debian/patches/upstream/0001-lcr-fixed-checking-if-there-is-more-uris-available-f.patch
@@ -0,0 +1,31 @@
+From 1b3e22dcb12d650e08316c28382dc224e9b75148 Mon Sep 17 00:00:00 2001
+From: Daniel-Constantin Mierla <miconda@gmail.com>
+Date: Mon, 12 Feb 2018 08:50:54 +0100
+Subject: [PATCH] lcr: fixed checking if there is more uris available for
+ next_gw
+
+- manual backport for 732a3153a0a41d5f951fff85de607f0b46ae73da
+
+(cherry picked from commit 43c9ad6f4dc2e20dd40a2d3dfa6b03f3dd79e3d4)
+---
+ modules/lcr/lcr_mod.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/modules/lcr/lcr_mod.c b/modules/lcr/lcr_mod.c
+index a90fb89..91a3f40 100644
+--- a/modules/lcr/lcr_mod.c
++++ b/modules/lcr/lcr_mod.c
+@@ -2460,8 +2460,8 @@ static int next_gw(struct sip_msg* _m, char* _s1, char* _s2)
+ 	 * Take Request-URI user from ruri_user_avp and generate Request
+          * and Destination URIs. */
+ 
+-	if (!generate_uris(_m, r_uri, &(ruri_user_val.s), &r_uri_len, dst_uri,
+-			   &dst_uri_len, &addr, &gw_index, &flags, &tag_str)) {
++	if (generate_uris(_m, r_uri, &(ruri_user_val.s), &r_uri_len, dst_uri,
++			   &dst_uri_len, &addr, &gw_index, &flags, &tag_str) <= 0) {
+ 	    return -1;
+ 	}
+     }
+-- 
+2.7.4
+
diff --git a/debian/patches/upstream/0002-tmx-allocate-space-to-store-ending-0-for-branch-valu.patch b/debian/patches/upstream/0002-tmx-allocate-space-to-store-ending-0-for-branch-valu.patch
new file mode 100644
index 000000000..00d950476
--- /dev/null
+++ b/debian/patches/upstream/0002-tmx-allocate-space-to-store-ending-0-for-branch-valu.patch
@@ -0,0 +1,28 @@
+From 5cd6530e68ef311a59acbec180588a498f2a32dc Mon Sep 17 00:00:00 2001
+From: Daniel-Constantin Mierla <miconda@gmail.com>
+Date: Sat, 10 Feb 2018 22:05:42 +0100
+Subject: [PATCH] tmx: allocate space to store ending 0 for branch value
+
+- reported by Alfred Farrugia and Sandro Gauci
+
+(cherry picked from commit e1d8008a09d9390ebaf698abe8909e10dfec4097)
+---
+ src/modules/tmx/tmx_pretran.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/modules/tmx/tmx_pretran.c b/modules/tmx/tmx_pretran.c
+index 494bdff..67c4f7f 100644
+--- a/modules/tmx/tmx_pretran.c
++++ b/modules/tmx/tmx_pretran.c
+@@ -260,7 +260,7 @@ int tmx_check_pretran(sip_msg_t *msg)
+ 	if(likely(vbr!=NULL)) {
+ 		svbranch = vbr->value;
+ 		trim(&svbranch);
+-		dsize += svbranch.len;
++		dsize += svbranch.len + 1;
+ 	}
+ 	if(dsize<256) dsize = 256;
+ 
+-- 
+2.7.4
+