dali/bacnet_stack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WriteProperty decoding length underflow (#1231)

Browse Source 
When decoding the optional priority context tag in wp_decode_service_request(), the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode instead of apdu_size - apdu_len. Similar typo in bacnet_action_command_decode().
This commit is contained in:
Steve Karg
2026-02-13 08:44:39 -06:00
committed by GitHub
parent 05027855ef
commit 4cc8067c86
3 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/bacnet/wp.c
+1 -1
View File
@@ -277,7 +277,7 @@ int wp_decode_service_request(
}
if ((unsigned)apdu_len < apdu_size) {
len = bacnet_unsigned_context_decode(
&apdu[apdu_len], apdu_len - apdu_size, 4, &unsigned_value);
&apdu[apdu_len], apdu_size - apdu_len, 4, &unsigned_value);
if (len > 0) {
apdu_len += len;
if ((unsigned_value >= BACNET_MIN_PRIORITY) &&