Bug #61: add strict decoding for TimeSynchronization

Makefile

@@ -118,6 +118,7 @@ clean:
 	$(MAKE) -s -C apps/router clean
 	$(MAKE) -s -C apps/router-ipv6 clean
 	$(MAKE) -s -C apps/gateway clean
+	$(MAKE) -s -C test clean
 
 .PHONY: test
 test:

src/bacnet/bacdcode.c

@@ -1037,7 +1037,11 @@ int decode_context_octet_string(
         !decode_is_closing_tag(&apdu[len])) {
         len += decode_tag_number_and_value(&apdu[len], &tag_number, &len_value);
 
-        status = octetstring_init(octet_string, &apdu[len], len_value);
+        if (len_value > 0) {
+            status = octetstring_init(octet_string, &apdu[len], len_value);
+        } else {
+            status = octetstring_init(octet_string, NULL, 0);
+        }
 
         if (status) {
             len += len_value;

src/bacnet/timesync.c

@@ -264,7 +264,11 @@ int timesync_decode_timesync_recipients(
             if (tag_number != BACNET_APPLICATION_TAG_OCTET_STRING) {
                 return BACNET_STATUS_ABORT;
             }
-            len = decode_octet_string(&apdu[0], len_value_type, &octet_string);
+            len = bacnet_octet_string_decode(&apdu[apdu_len],
+                max_apdu, len_value_type, &octet_string);
+            if (len < 0) {
+                return BACNET_STATUS_ERROR;
+            }
             apdu_len += len;
             if (octetstring_length(&octet_string) == 0) {
                 /* -- A string of length 0 indicates a broadcast */