Fixed usage of Keylist_Data_Add() return value in Calendar, CharacterString Value, Load Control, and BACnet/SC Network Port objects. (#1016)

CHANGELOG.md

@@ -48,6 +48,9 @@ The git repositories are hosted at the following sites:
 
 ### Fixed
 
+* Fixed usage of Keylist_Data_Add() return value in Calendar,
+  CharacterString Value, Load Control, and BACnet/SC Network Port
+  objects. (#1016)
 * Fixed BACnet/IP initialization on a network interface where the system
   reports the interface's unicast IP address as being the same as its
   broadcast IP address (e.g., utunX interfaces for VPNs on macOS). (#1011)

src/bacnet/basic/object/calendar.c

@@ -236,7 +236,7 @@ Calendar_Date_List_Get(uint32_t object_instance, uint8_t index)
 bool Calendar_Date_List_Add(
     uint32_t object_instance, const BACNET_CALENDAR_ENTRY *value)
 {
-    bool st = false;
+    int index = 0;
     BACNET_CALENDAR_ENTRY *entry;
     struct object_data *pObject;
 
@@ -249,12 +249,15 @@ bool Calendar_Date_List_Add(
     if (!entry) {
         return false;
     }
-
     *entry = *value;
-    st = Keylist_Data_Add(
+    index = Keylist_Data_Add(
         pObject->Date_List, Keylist_Count(pObject->Date_List), entry);
+    if (index < 0) {
+        free(entry);
+        return false;
+    }
 
-    return st;
+    return true;
 }
 
 /**

src/bacnet/basic/object/csv.c

@@ -85,6 +85,7 @@ void CharacterString_Value_Property_Lists(
 uint32_t CharacterString_Value_Create(uint32_t object_instance)
 {
     struct characterstring_object *pObject = NULL;
+    int index;
 
     if (object_instance > BACNET_MAX_INSTANCE) {
         return BACNET_MAX_INSTANCE;
@@ -101,7 +102,7 @@ uint32_t CharacterString_Value_Create(uint32_t object_instance)
         pObject = calloc(1, sizeof(struct characterstring_object));
         if (pObject) {
             /* add to list */
-            int index = Keylist_Data_Add(Object_List, object_instance, pObject);
+            index = Keylist_Data_Add(Object_List, object_instance, pObject);
             if (index < 0) {
                 free(pObject);
                 return BACNET_MAX_INSTANCE;

src/bacnet/basic/object/lc.c

@@ -1351,7 +1351,14 @@ static bool Load_Control_Shed_Levels_Write(BACNET_WRITE_PROPERTY_DATA *wp_data)
                     entry = Keylist_Data_Delete_By_Index(
                         pObject->Shed_Level_List, index);
                     key = (uint32_t)unsigned_value;
-                    Keylist_Data_Add(pObject->Shed_Level_List, key, entry);
+                    index =
+                        Keylist_Data_Add(pObject->Shed_Level_List, key, entry);
+                    if (index < 0) {
+                        wp_data->error_class = ERROR_CLASS_PROPERTY;
+                        wp_data->error_code =
+                            ERROR_CODE_NO_SPACE_TO_WRITE_PROPERTY;
+                        return false;
+                    }
                 } else {
                     wp_data->error_class = ERROR_CLASS_PROPERTY;
                     wp_data->error_code = ERROR_CODE_VALUE_OUT_OF_RANGE;
@@ -1370,7 +1377,13 @@ static bool Load_Control_Shed_Levels_Write(BACNET_WRITE_PROPERTY_DATA *wp_data)
                 entry = Keylist_Data_Delete_By_Index(
                     pObject->Shed_Level_List, index);
                 key = (uint32_t)unsigned_value;
-                Keylist_Data_Add(pObject->Shed_Level_List, key, entry);
+                index = Keylist_Data_Add(pObject->Shed_Level_List, key, entry);
+                if (index < 0) {
+                    wp_data->error_class = ERROR_CLASS_PROPERTY;
+                    wp_data->error_code = ERROR_CODE_NO_SPACE_TO_WRITE_PROPERTY;
+                    return false;
+                }
+
             } else {
                 wp_data->error_class = ERROR_CLASS_PROPERTY;
                 wp_data->error_code = ERROR_CODE_VALUE_OUT_OF_RANGE;

src/bacnet/basic/object/objects.c

@@ -54,6 +54,7 @@ OBJECT_DEVICE_T *objects_device_new(uint32_t device_instance)
 {
     OBJECT_DEVICE_T *pDevice = NULL;
     KEY key = device_instance;
+    int index;
 
     objects_init();
     if (Device_List) {
@@ -67,8 +68,15 @@ OBJECT_DEVICE_T *objects_device_new(uint32_t device_instance)
                 pDevice->Object_Identifier.type = OBJECT_DEVICE;
                 pDevice->Object_Identifier.instance = device_instance;
                 pDevice->Object_Type = OBJECT_DEVICE;
-                pDevice->Object_List = Keylist_Create();
+                index = Keylist_Data_Add(Device_List, key, pDevice);
-                Keylist_Data_Add(Device_List, key, pDevice);
+                if (index < 0) {
+                    /* unable to add */
+                    free(pDevice);
+                    pDevice = NULL;
+                } else {
+                    /* successfully added */
+                    pDevice->Object_List = Keylist_Create();
+                }
             }
         }
     }

src/bacnet/basic/object/sc_netport.c

@@ -734,27 +734,31 @@ bool Network_Port_Routing_Table_Add(
     uint8_t status,
     uint8_t performance_index)
 {
-    bool st = false;
+    int index;
     uint8_t network_type;
     BACNET_ROUTER_ENTRY *entry;
-    BACNET_SC_PARAMS *params = Network_Port_SC_Params(object_instance);
+    BACNET_SC_PARAMS *params;
+
+    params = Network_Port_SC_Params(object_instance);
     if (!params) {
         return false;
     }
-
     network_type = Network_Port_Type(object_instance);
     entry = calloc(1, sizeof(BACNET_ROUTER_ENTRY));
     if (!entry) {
         return false;
     }
-
     entry->Network_Number = network_number;
     MAC_Address_Set(network_type, entry->Mac_Address, mac, mac_len);
     entry->Status = status;
     entry->Performance_Index = performance_index;
-    st = Keylist_Data_Add(params->Routing_Table, network_number, entry);
+    index = Keylist_Data_Add(params->Routing_Table, network_number, entry);
+    if (index < 0) {
+        free(entry);
+        return false;
+    }
 
-    return st;
+    return true;
 }
 
 bool Network_Port_Routing_Table_Delete(