dali/bacnet_stack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bugfix/ubasic-string-tokenizer-null-termination (#1196)

Browse Source 
* Fixed tokenizer_string() off-by-one buffer overflow when processing string literals longer than the buffer limit.

* Fixed ubasic potential string buffer overflows by using snprintf instead of sprintf.

* Fixed ubasic label strings to use UBASIC_LABEL_LEN_MAX as buffer limit.

* Fixed ubasic string variables to initialize with zeros.

* Fixed compile errors when UBASIC_DEBUG_STRINGVARIABLES is defined.

* Added ubasic string variables user accessor API and unit testing for ubasic string variables.

* Fixed tokenizer_label() off-by-one buffer overflow when processing string literals longer than the buffer limit.
This commit is contained in:
Steve Karg
2026-01-03 15:11:34 -06:00
committed by GitHub
parent d40188a8ec
commit 4e1176394a
5 changed files with 131 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+9 -1
View File
@@ -12,12 +12,20 @@ The git repositories are hosted at the following sites:
* https://bacnet.sourceforge.net/
* https://github.com/bacnet-stack/bacnet-stack/
## [Unreleased] - 2025-12-04
## [Unreleased] - 2026-01-03
### Security
* Secured npdu_is_expected_reply() function where the MS/TP reply matcher
could have an out-of-bounds read. (#1178)
* Secured ubasic interpreter tokenizer_string() and tokenizer_label()
off-by-one buffer overflow when processing string literals longer
than the buffer limit.
Fixed ubasic potential string buffer overflows by using snprintf.
Fixed ubasic label strings to use UBASIC_LABEL_LEN_MAX as buffer limit.
Fixed ubasic string variables to initialize with zeros.
Fixed compile errors when UBASIC_DEBUG_STRINGVARIABLES is defined.
Added ubasic string variables user accessor API and unit testing. (#1196)
### Added