isisd: Fix remaining buffer size calculation in lsp_bits2string

[rbgarga]

Summary

The lsp_bits2string function was incorrectly passing the total
buf_size to subsequent snprintf calls instead of the remaining
buffer space. This caused the compiler's _FORTIFY_SOURCE security
checks to trigger a SIGABRT, as the requested write size exceeded
the actual remaining bounds of the buffer.

I started seeing this crash after building FRR with clang 18 on
Ubuntu 24.04.

Corrected the size argument by properly subtracting the already
consumed space (pos - buf) from the total buf_size.

Related Issue

Components

isisd

[greptile-apps]

Greptile Summary

This PR fixes a critical buffer overflow vulnerability in the lsp_bits2string function. The function was incorrectly passing the total buffer size to subsequent snprintf calls instead of calculating the remaining buffer space, causing _FORTIFY_SOURCE security checks to trigger SIGABRT.

Key changes:

• Corrected three snprintf calls (lines 701, 704, 707) to use buf_size - (pos - buf) instead of buf_size
• Ensures each write operation is informed of the actual remaining buffer space
• Prevents buffer overflow detection by modern compiler security features

The fix is straightforward and correct: when pos advances after each write, the remaining space calculation now properly accounts for the consumed bytes.

Confidence Score: 5/5

• This PR is safe to merge with no risk - it fixes a critical security issue
• The fix correctly addresses a buffer overflow vulnerability with a standard pattern. The change is minimal, focused, and follows best practices for calculating remaining buffer space in sequential snprintf operations.
• No files require special attention

Important Files Changed

Filename	Overview
isisd/isis_lsp.c	Fixed buffer size calculation to use remaining space instead of total size, preventing SIGABRT from fortify checks

_{Last reviewed commit: 729574a}

[mjstapp]

thanks, looks good
(and I don't mind the line-break that clang-format complains about)

[mjstapp]

@Mergifyio backport dev/10.6

[mergify]

backport dev/10.6

✅ Backports have been created

Details

• #20987 isisd: Fix remaining buffer size calculation in lsp_bits2string (backport #20984) has been created for branch dev/10.6