Commit 4de2d00ef4 for frr

commit 4de2d00ef4becc46ebe7de65c16e9e4a004af37a
Author: Mark Stapp <mjs@cisco.com>
Date:   Fri Oct 30 15:51:09 2026 -0400

    isisd: reject overflowing 32-bit metric values

    For IPv4, IPv6, and srv6 locators, avoid overflowing metric
    value, skip them during SPF.

    Reported-by: Anthropic's OSS Scanner, as vulnerability ANT-2026-NIVKT53A.
    Signed-off-by: Mark Stapp <mjs@cisco.com>

diff --git a/isisd/isis_spf.c b/isisd/isis_spf.c
index 46831388c6..e4bbd22db6 100644
--- a/isisd/isis_spf.c
+++ b/isisd/isis_spf.c
@@ -984,6 +984,14 @@ lspfragloop:
 		struct isis_extended_ip_reach *r;
 		for (r = ipv4_reachs ? (struct isis_extended_ip_reach *)ipv4_reachs->head : NULL;
 		     r; r = r->next) {
+			/*
+			 * RFC 5305 section 4: a prefix advertised with a metric
+			 * larger than MAX_PATH_METRIC MUST NOT be considered
+			 * during the normal SPF computation.
+			 */
+			if ((uint64_t)cost + r->metric > MAX_WIDE_PATH_METRIC)
+				continue;
+
 			dist = cost + r->metric;
 			ip_info.dest.u.prefix4 = r->prefix.prefix;
 			ip_info.dest.prefixlen = r->prefix.prefixlen;
@@ -1034,6 +1042,10 @@ lspfragloop:
 		struct isis_ipv6_reach *r;
 		for (r = ipv6_reachs ? (struct isis_ipv6_reach *)ipv6_reachs->head : NULL; r;
 		     r = r->next) {
+			/* RFC 5308 section 2, see the IPv4 case above */
+			if ((uint64_t)cost + r->metric > MAX_WIDE_PATH_METRIC)
+				continue;
+
 			dist = cost + r->metric;
 			vtype = r->external ? VTYPE_IP6REACH_EXTERNAL : VTYPE_IP6REACH_INTERNAL;
 			memset(&ip_info, 0, sizeof(ip_info));
@@ -1099,6 +1111,10 @@ lspfragloop:
 			if (loc->algorithm != SR_ALGORITHM_SPF)
 				continue;

+			/* RFC 9352 section 7.1, see the IPv4 case above */
+			if ((uint64_t)cost + loc->metric > MAX_WIDE_PATH_METRIC)
+				continue;
+
 			dist = cost + loc->metric;
 			vtype = VTYPE_IP6REACH_INTERNAL;
 			memset(&ip_info, 0, sizeof(ip_info));