[FROG] isis_tlvs.c : bugs in unpack_item_ext_subtlvs()

[himanshu sardana]

Hi FRR team,

File: https://github.com/FRRouting/frr/blob/master/isisd/isis_tlvs.c

In unpack_item_ext_subtlvs() there are few sub-tlvs whose unpacking need to
be fixed.

Basically 2 fixes are required:
1. Default length of sub-tlvs are not correct
2. If length is not as per standard, then pointer has to be advanced to the
length value.

In below example, these 2 fixes are tagged as FIXME#1 and FIXME#2

For example:
unpack_item_ext_subtlvs() {
. . .
. . .
    case ISIS_SUBTLV_MM_DELAY:
        if (subtlv_len != ISIS_SUBTLV_DEF_SIZE) {  // FIXME#1: As per
standard this is 8 byte
            sbuf_push(log, indent,
       "TLV size does not match expected size for Min/Max Link Delay!\n");
                // FIXME#2: Advance the pointer to subtlv_len i.e.
uncomment below line and add it in the code
                // stream_forward_getp(s, subtlv_len);
   }
. . .
. . .
}

Note: In unpack_item_ext_subtlvs(), there are other "case" as well that
needs the same 2 fix

Thanks,
Himanshu Rai
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.frrouting.org/pipermail/frog/attachments/20210610/fe5fc9f0/attachment.htm>