dali/bacnet_stack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WriteProperty decoding length underflow (#1231)

Browse Source 
When decoding the optional priority context tag in wp_decode_service_request(), the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode instead of apdu_size - apdu_len. Similar typo in bacnet_action_command_decode().
This commit is contained in:
Steve Karg
2026-02-13 08:44:39 -06:00
committed by GitHub
parent 05027855ef
commit 4cc8067c86
3 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+3 -1
View File
@@ -12,10 +12,12 @@ The git repositories are hosted at the following sites:
* https://bacnet.sourceforge.net/
* https://github.com/bacnet-stack/bacnet-stack/
## [Unreleased] - 2026-02-09
## [Unreleased] - 2026-02-13
### Security
* Secured decoding length underflow in wp_decode_service_request() and
bacnet_action_command_decode() which had similar issue. (#1231)
* Secured Schedule_Weekly_Schedule_Set() the example schedule object
by fixing stack buffer overflow. The memcpy was using
sizeof(BACNET_WEEKLY_SCHEDULE) instead of sizeof(BACNET_DAILY_SCHEDULE),