When FRR receives an IS-IS HELLO packet, it parses it and attempts to unpack the TLVs contained in it, resulting in a call trace that looks something like the following:

```
#0 unpack_tlvs() isisd/isis_tlvs.c
#1 isis_unpack_tlvs() in isisd/isis_tlvs.c
#2 process_hello() in isisd/isis_pdu.c
#3 isis_handle_pdu() in isisd/isis_pdu.c
```

Down the call stack, different TLV unpackers are called via ops-like structures holding function pointers, depending on the TLV type. One of these unpackers is `unpack_tlv_router_cap()`. Here, FRR allocates a new structure to hold the received information; however, if the transmitted length is greater than the actual amount of data sent, the function bails out.

```c
/* Functions related to TLV 242 Router Capability as per RFC7981 */
...
static int unpack_tlv_router_cap(...)
{
	...
	/* Allocate router cap structure and initialize SR Algorithms */
	rcap = XCALLOC(MTYPE_ISIS_TLV, sizeof(struct isis_router_cap));
	...
	while (...) {
		...
		if (length > STREAM_READABLE(s) || length > subtlv_len - 2) {
			stream_forward_getp(s, STREAM_READABLE(s));
			return 0;
		}
		...
	}
	...
	tlvs->router_cap = rcap;
	return 0;
}
```

Note that the pointer to the allocated structure (`rcap`) is leaked once the function returns with an error, since it is never freed. Normally, this structure would be freed via `isis_free_tlvs()` after the error bubbles up from `unpack_tlv_router_cap()` back to `process_hello()`:

```c
static int process_hello(...)
{
	...
	if (isis_unpack_tlvs(STREAM_READABLE(circuit->rcv_stream),
			     circuit->rcv_stream, &iih.tlvs, &error_log)) {
		/* error ... */
		goto out;
	}
	...
out:
	isis_free_tlvs(iih.tlvs);

	return retval;
}
```

```c
void isis_free_tlvs(struct isis_tlvs *tlvs) {
	...
	free_tlv_router_cap(tlvs->router_cap);
	...
}
```

This issue could be exploited to exhaust the routing server's available memory, albeit slowly, eventually leading to denial of service.

This issue was fixed with the following commit:
https://github.com/FRRouting/frr/commit/49efc80d342d8e8373c8af040580bd7940808730