Skip to content

WriteProperty decoding length underflow - #1231

Merged
skarg merged 2 commits into
masterfrom
bugfix/wp-out-of-bounds-read
Feb 13, 2026
Merged

WriteProperty decoding length underflow#1231
skarg merged 2 commits into
masterfrom
bugfix/wp-out-of-bounds-read

Conversation

@skarg

@skarg skarg commented Feb 13, 2026

Copy link
Copy Markdown
Collaborator

When decoding the optional priority context tag in wp_decode_service_request(), the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode instead of apdu_size - apdu_len. Similar typo in bacnet_action_command_decode().

…request(), the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode instead of apdu_size - apdu_len. Similar typo in bacnet_action_command_decode().
@skarg
skarg merged commit 4cc8067 into master Feb 13, 2026
40 of 41 checks passed
@skarg
skarg deleted the bugfix/wp-out-of-bounds-read branch February 13, 2026 14:44
skarg added a commit that referenced this pull request Feb 13, 2026
When decoding the optional priority context tag in wp_decode_service_request(), the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode instead of apdu_size - apdu_len. Similar typo in bacnet_action_command_decode().
metelik pushed a commit to se-apc/bacnet-stack that referenced this pull request Apr 22, 2026
When decoding the optional priority context tag in wp_decode_service_request(), the code passes apdu_len - apdu_size to bacnet_unsigned_context_decode instead of apdu_size - apdu_len. Similar typo in bacnet_action_command_decode().
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant