From 7536c6b6fa570f12b90a2f889b2aed86e0bb74d1 Mon Sep 17 00:00:00 2001
From: Steve Karg <skarg@users.sourceforge.net>
Date: Wed, 8 Apr 2026 16:35:31 -0500
Subject: [PATCH] Fix type limits for uint32_t in sscanf and printf across
 multiple files (#1298)

---
 src/bacnet/bacapp.c                   | 16 +++++++++-------
 src/bacnet/basic/object/time_value.c  |  6 ++++--
 src/bacnet/basic/service/h_getevent.c | 13 ++++++++++---
 3 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/src/bacnet/bacapp.c b/src/bacnet/bacapp.c
index 7467d747..6dd5885b 100644
--- a/src/bacnet/bacapp.c
+++ b/src/bacnet/bacapp.c
@@ -4712,7 +4712,8 @@ special_event_from_ascii(BACNET_APPLICATION_DATA_VALUE *value, char *str)
     char *period_str, *sched_str, *prio_str;
     BACNET_SPECIAL_EVENT *ev = &value->type.Special_Event;
     BACNET_UNSIGNED_INTEGER prio = 0;
-    uint32_t obj_type = 0, obj_instance = 0;
+    long unsigned int unsigned_value = 0;
+    uint32_t found_index = 0;
     char type_buf[64];
     char *colon;
     size_t tlen;
@@ -4776,19 +4777,20 @@ special_event_from_ascii(BACNET_APPLICATION_DATA_VALUE *value, char *str)
         }
         memcpy(type_buf, period_str, tlen);
         type_buf[tlen] = '\0';
-        count = sscanf(colon + 1, "%7u", &obj_instance);
+        count = sscanf(colon + 1, "%7lu", &unsigned_value);
         if (count != 1) {
             return false;
         }
-        ev->period.calendarReference.instance = obj_instance;
-        if (bactext_object_type_strtol(type_buf, &obj_type)) {
-            ev->period.calendarReference.type = (BACNET_OBJECT_TYPE)obj_type;
+        ev->period.calendarReference.instance = (uint32_t)unsigned_value;
+        if (bactext_object_type_strtol(type_buf, &found_index)) {
+            ev->period.calendarReference.type = (BACNET_OBJECT_TYPE)found_index;
         } else {
-            count = sscanf(type_buf, "%4u", &obj_type);
+            count = sscanf(type_buf, "%4lu", &unsigned_value);
             if (count != 1) {
                 return false;
             }
-            ev->period.calendarReference.type = (BACNET_OBJECT_TYPE)obj_type;
+            ev->period.calendarReference.type =
+                (BACNET_OBJECT_TYPE)unsigned_value;
         }
     }
     value->tag = BACNET_APPLICATION_TAG_SPECIAL_EVENT;
diff --git a/src/bacnet/basic/object/time_value.c b/src/bacnet/basic/object/time_value.c
index 8efb4bf4..f1b7bf3b 100644
--- a/src/bacnet/basic/object/time_value.c
+++ b/src/bacnet/basic/object/time_value.c
@@ -392,7 +392,7 @@ bool Time_Value_Object_Name(
 {
     bool status = false;
     struct object_data *pObject;
-    char name_text[16] = "Time-4194303";
+    char name_text[32] = "";
 
     pObject = Keylist_Data(Object_List, object_instance);
     if (pObject) {
@@ -400,7 +400,9 @@ bool Time_Value_Object_Name(
             status =
                 characterstring_init_ansi(object_name, pObject->Object_Name);
         } else {
-            snprintf(name_text, sizeof(name_text), "Time-%u", object_instance);
+            snprintf(
+                name_text, sizeof(name_text), "Time-Value-%lu",
+                (unsigned long)object_instance);
             status = characterstring_init_ansi(object_name, name_text);
         }
     }
diff --git a/src/bacnet/basic/service/h_getevent.c b/src/bacnet/basic/service/h_getevent.c
index 48dc9048..ce23fb88 100644
--- a/src/bacnet/basic/service/h_getevent.c
+++ b/src/bacnet/basic/service/h_getevent.c
@@ -39,13 +39,20 @@ void ge_ack_print_data(
 {
     unsigned int count = 0;
     BACNET_GET_EVENT_INFORMATION_DATA *act_data = data;
-    const char *state_strs[] = { "NO", "FA", "ON", "HL", "LL" };
+    const char *state_strs[EVENT_STATE_MAX] = { "NO", "FA", "ON", "HL", "LL" };
+    const char *state_str;
     printf("DeviceID\tType\tInstance\teventState\n");
     printf("--------------- ------- --------------- ---------------\n");
     while (act_data) {
+        if (act_data->eventState < EVENT_STATE_MAX) {
+            state_str = state_strs[act_data->eventState];
+        } else {
+            state_str = "??";
+        }
         printf(
-            "%u\t\t%u\t%u\t\t%s\n", device_id, act_data->objectIdentifier.type,
-            act_data->objectIdentifier.instance, state_strs[data->eventState]);
+            "%lu\t\t%u\t%lu\t\t%s\n", (unsigned long)device_id,
+            act_data->objectIdentifier.type,
+            (unsigned long)act_data->objectIdentifier.instance, state_str);
         act_data = act_data->next;
         count++;
     }