bsc: reject short proprietary option headers in BVLC-SC decode - #1396
Merged
skarg merged 1 commit intoJun 19, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens BACnet/SC BVLC-SC header option decoding by rejecting malformed proprietary header options that specify an invalid header-data length, preventing fixed-offset reads from occurring on too-short option bodies.
Changes:
- Add BVLC-SC option header validation to reject proprietary options with
hdr_len < 3(minimum vendor-id + option-type). - Make proprietary option decode initialize outputs and only read vendor-id/option-type when
hdr_len >= 3. - Add a regression test that injects a malformed proprietary option (
hdr_len = 2) and asserts decode fails withERROR_CODE_HEADER_ENCODING_ERROR.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
src/bacnet/datalink/bsc/bvlc-sc.c |
Adds stricter proprietary header option length validation and guards fixed-offset reads during proprietary option decode. |
test/bacnet/datalink/bvlc-sc/src/main.c |
Adds a malformed proprietary-option test case to ensure decode rejects hdr_len < 3. |
skarg
deleted the
bugfix/out-of-bounds-in-bacnet-sc-proprietary-header-option-decode
branch
June 19, 2026 19:02
skarg
added a commit
that referenced
this pull request
Jul 2, 2026
* Add BVLC-SC option header validation to reject proprietary options with hdr_len < 3 (minimum vendor-id + option-type). * Make proprietary option decode initialize outputs and only read vendor-id/option-type when hdr_len >= 3. * Add a regression test that injects a malformed proprietary option (hdr_len = 2) and asserts decode fails with ERROR_CODE_HEADER_ENCODING_ERROR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hdr_len < 3[3],[4],[5]) behindhdr_len >= 3hdr_len = 2)Security impact
A remote BACnet/SC peer could trigger heap out-of-bounds reads in proprietary header option decode before auth. This change blocks malformed options earlier and avoids unsafe fixed-offset reads.
Changes
src/bacnet/datalink/bsc/bvlc-sc.chdr_len >= 3test/bacnet/datalink/bvlc-sc/src/main.ctest_BAD_HEADER_OPTIONSto verify decode rejects proprietary options withhdr_len < 3Validation
cmake -S test/bacnet/datalink/bvlc-sc -B test/build-bsc-bvlccmake --build test/build-bsc-bvlc./test/build-bsc-bvlc/test_bvlc-scpre-commit run --files src/bacnet/datalink/bsc/bvlc-sc.c test/bacnet/datalink/bvlc-sc/src/main.c