isisd: Reject SRv6 Locator TLV with Loc-Size of zero

[cscarpitta]

RFC 9352 Section 7.1 requires Loc-Size to be in the range 1-128. A value of zero is invalid and must cause the entire TLV to be ignored. The existing check only rejects values greater than 128, allowing zero through and producing a zero-length prefix that can confuse downstream consumers.

Fix this by extending the condition to also reject zero:

  if (rv->prefix.prefixlen == 0 || rv->prefix.prefixlen > IPV6_MAX_BITLEN)

[cscarpitta]

@Mergifyio backport stable/10.6 stable/10.5 stable/10.4 stable/10.3

[mergify]

backport stable/10.6 stable/10.5 stable/10.4 stable/10.3

✅ Backports have been created

Details

• #21665 isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641) has been created for branch stable/10.6
• #21666 isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641) has been created for branch stable/10.5
• #21667 isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641) has been created for branch stable/10.4
• #21668 isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641) has been created for branch stable/10.3

[greptile-apps]

Greptile Summary

This PR adds a missing zero-check to the unpack_item_srv6_locator function in isisd/isis_tlvs.c, enforcing RFC 9352 Section 7.1's requirement that Loc-Size must be in the range [1, 128]. Before this fix, a Loc-Size of 0 would pass validation, producing a zero-length IPv6 prefix that could confuse downstream SRv6 consumers. The fix is minimal and correct: the goto out path correctly frees allocated memory and returns an error.

Confidence Score: 5/5

Safe to merge — minimal, targeted RFC 9352 compliance fix with no side effects.

The change is a single-line addition of a zero-check that directly implements an explicit RFC requirement. The error path (goto out) correctly frees allocated memory and was already tested by the > IPV6_MAX_BITLEN branch. No new logic paths, no behavioral changes for valid input, and no ripple effects elsewhere in the codebase.

No files require special attention.

Important Files Changed

Filename	Overview
isisd/isis_tlvs.c	Single-line fix adding prefixlen == 0 guard in unpack_item_srv6_locator to fully enforce RFC 9352 Section 7.1 Loc-Size range [1, 128]; error path correctly frees memory.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["unpack_item_srv6_locator()"] --> B["Read 7 mandatory bytes\n(metric, flags, algorithm, loc-size)"]
    B --> C{"len < 7?"}
    C -- yes --> OUT["goto out\n(free rv, return 1)"]
    C -- no --> D["rv->prefix.prefixlen = stream_getc(s)"]
    D --> E{"prefixlen == 0\nOR\nprefixlen > 128?"}
    E -- yes --> OUT
    E -- no --> F["Read prefix bytes\nApply mask"]
    F --> G["Read sub-TLV length"]
    G --> H{"subtlv_len > 0?"}
    H -- yes --> I["Unpack sub-TLVs"]
    H -- no --> J["append_item(), return 0"]
    I --> J

Loading

_{Reviews (1): Last reviewed commit: "isisd: Reject SRv6 Locator TLV with Loc-..." | Re-trigger Greptile}

[donaldsharp]

@Mergifyio backport stable/10.6 stable/10.5 stable/10.4 stable/10.3 stable/10.2 stable/10.1 stable/10.0

[mergify]

backport stable/10.6 stable/10.5 stable/10.4 stable/10.3 stable/10.2 stable/10.1 stable/10.0

❌ No backport have been created

Details

• Backport to branch stable/10.6 failed

Git reported the following error:

To https://github.com/FRRouting/frr
 ! [rejected]              mergify/bp/stable/10.6/pr-21641 -> mergify/bp/stable/10.6/pr-21641 (non-fast-forward)
error: failed to push some refs to 'https://github.com/FRRouting/frr'
hint: Updates were rejected because the tip of your current branch is behind
hint: its remote counterpart. Integrate the remote changes (e.g.
hint: 'git pull ...') before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.

• Backport to branch stable/10.5 failed

Git reported the following error:

To https://github.com/FRRouting/frr
 ! [rejected]              mergify/bp/stable/10.5/pr-21641 -> mergify/bp/stable/10.5/pr-21641 (non-fast-forward)
error: failed to push some refs to 'https://github.com/FRRouting/frr'
hint: Updates were rejected because the tip of your current branch is behind
hint: its remote counterpart. Integrate the remote changes (e.g.
hint: 'git pull ...') before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.

• Backport to branch stable/10.4 failed

Git reported the following error:

To https://github.com/FRRouting/frr
 ! [rejected]              mergify/bp/stable/10.4/pr-21641 -> mergify/bp/stable/10.4/pr-21641 (non-fast-forward)
error: failed to push some refs to 'https://github.com/FRRouting/frr'
hint: Updates were rejected because the tip of your current branch is behind
hint: its remote counterpart. Integrate the remote changes (e.g.
hint: 'git pull ...') before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.

• Backport to branch stable/10.3 failed

Git reported the following error:

To https://github.com/FRRouting/frr
 ! [rejected]              mergify/bp/stable/10.3/pr-21641 -> mergify/bp/stable/10.3/pr-21641 (non-fast-forward)
error: failed to push some refs to 'https://github.com/FRRouting/frr'
hint: Updates were rejected because the tip of your current branch is behind
hint: its remote counterpart. Integrate the remote changes (e.g.
hint: 'git pull ...') before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.

• #21669 isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641) has been created for branch stable/10.2
• #21670 isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641) has been created for branch stable/10.1
• #21671 isisd: Reject SRv6 Locator TLV with Loc-Size of zero (backport #21641) has been created for branch stable/10.0