* Fix stack buffer overflow in Schedule_Weekly_Schedule_Set
The memcpy was using sizeof(BACNET_WEEKLY_SCHEDULE) instead of
sizeof(BACNET_DAILY_SCHEDULE), causing it to read 6784 bytes from
a 968-byte source buffer, leading to stack buffer overflow and
segmentation fault in the test_schedule unit test.
This fixes the test_schedule test failure detected by ASAN:
ERROR: AddressSanitizer: stack-buffer-overflow on address ...
READ of size 6784 at 0x... partially underflows this variable
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Update src/bacnet/basic/object/schedule.c
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: kent.liu <kent.liu@designlibro.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Steve Karg <steve@kargs.net>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Added example Device object and property value backup using create-object list-of-initial-values and writable properties. Initiated using ReinitializeDevice with STARTBACKUP command. Added backup and restore required properties to the Device object.
* Fixed fwrite parameters in bacfile_posix_write_stream_data to return the correct number of bytes written.
* Added Device Management-Backup and Restore-B (DM-BR-B) conversion to Wireshark PCAP format command line utility in apps/dmbrcap which decodes and provides a view of the binary backup file.
* Added Send_UEvent_Notify_Device function for device-specific unconfirmed event notifications.
* Fixed event_notify_parse() loop index to start from zero.
* Added device ID binding support in the UEvent command-line application.
* Fixed the UEvent command-line application help output.
* Fixed initialization of event data in the UEvent command-line application by adding static CharacterString for message text and handling the failure case.
* Added Blink.Callback and Blink.Priority to support end-of-blink actions for WARN_OFF/WARN_RELINQUISH. The Blink.Callback is invoked when a blink sequence ends or when a new command interrupts a WARN_OFF/WARN_RELINQUISH in progress.
* Added Lighting Output (LO) WARN_OFF/WARN_RELINQUISH post-egress priority array handling using the Blink.Callback
* Fixed lighting output object lighting-commands for warn-off and warn-relinquish when blink-warn notification shall not occur.
* Fixed timer object task to initiate a write-request at expiration.
* Added channel and timer object write-property observers in blinkt app to monitor internal writes.
* Added vacancy timer command line argument in blinkt app for testing initial timer object vacancy time for lights channel.
* Changed apps to build at protocol-revision 28 to be able to use the lighting output special values by default.
* Fixed blinkt app server name and removed the device.c module which was no longer needed.
* Added debug prints for lighting-output object for present-value and lighting-command property values which may be out-of-range.
* Added API to get the RGB pixel and brightness values from the blinkt interface.
* Fixed Channel object for Color object present-value which does not use coercion.
* Added API to the color-RGB library to convert from ASCII CSS color name to X,Y and brightness.
* Converted the Blinkt example app to use the basic-server. Added a default color name command line option --color that accepts CSS color names. Set the color and brightness at startup.
* Added vacancy timer for lights using timer object defaulted to 30m and started at startup.
* Added enumeration text lookup for BACnetAuthenticationStatus, BACnetAuthorizationMode, BACnetAccessCredentialDisable, BACnetAccessCredentialDisableReason, BACnetAccessUserType, BACnetAccessZoneOccupancyState, BACnetWriteStatus, BACnetIPMode, BACnetDoorValue, BACnetMaintenance, BACnetEscalatorFault, BACnetEscalatorMode, BACnetEscalatorOperationDirection, BACnetBackupState, BACnetSecurityLevel, BACnetLiftCarDirection, BACnetLiftCarDoorCommand, BACnetLiftCarDriveStatus, BACnetLiftCarMode, BACnetLiftFault, BACnetLiftGroupMode, BACnetAuditLevel, BACnetAuditOperation, BACnetSCHubConnectorState, BACnetSCConnectionState, BACnetNodeRelationship, BACnetAction, BACnetFileAccessMethod, BACnetLockStatus, BACnetDoorAlarmState, BACnetDoorStatus, BACnetDoorSecuredStatus, and BACnetAccessEvent.
* Created BINARY_PV_MAX with the same semantic meaning as one more than the last valid enumeration, and deprecated MAX_BINARY_PV usage in the examples.
* Reduced code size by using bactext_property_states_strtoul() instead of individual API for each enumations.
Added a new API for writable property lists across all the basic example object types, preparing for the introduction of a Writable_Property_List property in every object in a future BACnet standard revision.
The lists can be used by backup and restore feature to automatically choose the object property values in the backup that can be restored via internal WriteProperty directly from BACnet CreateObject services with List of Initial Values.
Updated existing device object examples to include these writable property lists.
* Fixed lighting output object lighting-command last-on-value to only
be updated with the last value of the Present_Value property that
was greater than or equal to 1.0%, keeping in mind that the Present_Value
shall indicate the target level of the operation and not the current
value.
Fixes the CreateObject service list-of-initial-values encoding and decoding by refactoring the data structure to be similar to WriteProperty. The implementation changes from using a linked list of property values to using a flat buffer approach with delayed decoding.
Changes:
* Refactored BACNET_CREATE_OBJECT_DATA structure to use an application_data buffer instead of a linked list for initial values
* Added a new create_object_process() and create_object_initializer_list_process() functions to centralize object creation logic and error reporting
* Updated all device implementations to use the new centralized creation functions
* Enhanced the create-object example application to support command-line specification of initial property values
* Added comprehensive test coverage for the new encoding/decoding and processing functions
* Fixed BACnet file object path name unintended path traversals by optionally restricting path name content with BACNET_FILE_PATH_RESTRICTED define.
* Added POSIX file path name checking for AtomicReadFile and AtomicWriteFile example applications. Prohibits use of relative and absolute file paths when BACNET_FILE_PATH_RESTRICTED is non-zero.
* Fixed tokenizer_string() off-by-one buffer overflow when processing string literals longer than the buffer limit.
* Fixed ubasic potential string buffer overflows by using snprintf instead of sprintf.
* Fixed ubasic label strings to use UBASIC_LABEL_LEN_MAX as buffer limit.
* Fixed ubasic string variables to initialize with zeros.
* Fixed compile errors when UBASIC_DEBUG_STRINGVARIABLES is defined.
* Added ubasic string variables user accessor API and unit testing for ubasic string variables.
* Fixed tokenizer_label() off-by-one buffer overflow when processing string literals longer than the buffer limit.
* Fixed lighting-output object blink warn to honor blink-warn-enable.
* Fixed the blink warn logic for a non-zero percent value blink inhibit.
* Fixed the warn relinquish to actually relinquish.
* Refactored BACnetShedLevel encoding, decoding, and printing into separate file. Added unit testing.
* Added API to load control object for shed-level, start-time, duty-window, full-duty-baseline, and enable.
* Fixed bacapp sprintf for shed level and host-n-port found in scan build.
* Updated documentation for encode functions to accurately describe return values (0 on error instead of BACNET_STATUS_ERROR)
* Expanded property support, removed INPUT object types, added fallback encoding for non-coerced data types, and updated error handling in ReadProperty of present-value to check for 0 instead of BACNET_STATUS_ERROR.
* Expanded the validation tests and increased test code coverage.
* Fixed the loop object empty reference property by initializing to self. When configured for self, the manipulated property value will update the controlled variable value for simulation.
* Changed min/max output and update-interval defaults.
Added segmentation support for server devices for some services. Configure BACNET_SEGMENTATION_ENABLED=1 to include in the library, and adjust BACNET_MAX_SEGMENTS_ACCEPTED for maximum number of segments.
* Refactored the BACnet/SC datalink initialization order by moving certificate file checks and hub connection registration to occur after datalink initialization
* Replaced stdlib rand() with platform-specific cryptographically secure random functions (RtlGenRandom for Windows, getrandom for Linux, arc4random_buf for BSD) to generate UUID and VMAC addresses, preventing duplicates that broke connections
* Enabled conditional debug output in BACnet/SC components when BUILD=debug is specified
* Added a new getter API function Timer_State_Change_Value_Get() to the timer object that returns state-change values by copying them to a caller-provided buffer, providing a safer alternative to the existing Timer_State_Change_Value() function which returns a direct pointer to internal data.
Steve Karg