Skip to content

Channel member self-reference causes uncontrolled recursion - #1345

Merged
skarg merged 3 commits into
masterfrom
bugfix/channel-member-self-reference-uncontrolled-recursion
May 13, 2026
Merged

Channel member self-reference causes uncontrolled recursion#1345
skarg merged 3 commits into
masterfrom
bugfix/channel-member-self-reference-uncontrolled-recursion

Conversation

@skarg

@skarg skarg commented May 12, 2026

Copy link
Copy Markdown
Collaborator

PROP_LIST_OF_OBJECT_PROPERTY_REFERENCES accepts a self-referential entry pointing back to the same Channel object's PROP_PRESENT_VALUE. A subsequent WriteProperty request to that Channel object's PROP_PRESENT_VALUE causes the implementation to re-expand the persisted member reference through the internal Device_Write_Property callback, creating an unbounded recursive loop:

Channel_Write_Property -> Channel_Present_Value_Write -> Channel_Write_Members -> Device_Write_Property -> Channel_Write_Property -> ...

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the Channel object against unbounded recursive writes caused by self-referential entries in PROP_LIST_OF_OBJECT_PROPERTY_REFERENCES, preventing WriteProperty(PROP_PRESENT_VALUE) from re-entering the Channel write path indefinitely.

Changes:

  • Adds a re-entrancy guard in Channel_Write_Members() using Write_Status to stop recursive member expansion.
  • Rejects direct self-references to the same Channel’s PROP_PRESENT_VALUE when writing PROP_LIST_OF_OBJECT_PROPERTY_REFERENCES.
  • Refactors array-element decoding for PROP_LIST_OF_OBJECT_PROPERTY_REFERENCES and PROP_CONTROL_GROUPS to use type-specific decoders and clearer error mapping.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/bacnet/basic/object/channel.c
@skarg
skarg merged commit 343a742 into master May 13, 2026
36 checks passed
@skarg
skarg deleted the bugfix/channel-member-self-reference-uncontrolled-recursion branch May 13, 2026 18:03
skarg added a commit that referenced this pull request May 18, 2026
* Secured Channel object member self-reference that caused uncontrolled recursion.

* Changed Channel property handling to use device object property reference and unsigned value specific decoders.

* Fixed handling of Write_Status in Channel_Write_Members to properly reflect success or failure of property writes.
skarg added a commit that referenced this pull request May 26, 2026
    * Fix uncontrolled recursion in Channel_Write_Members and add self-reference check for channel members

    * Refactor Channel property handling to use device object property reference and unsigned value specific decoders

    * Fix handling of Write_Status in Channel_Write_Members to properly reflect success or failure of property writes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants