Skip to content

fix: handle file access method mismatch in atomic read/write file services - #1439

Merged
skarg merged 3 commits into
masterfrom
bugfix/ramfs-atomic-write-file-stream-method-mismatch
Jul 27, 2026
Merged

fix: handle file access method mismatch in atomic read/write file services#1439
skarg merged 3 commits into
masterfrom
bugfix/ramfs-atomic-write-file-stream-method-mismatch

Conversation

@skarg

@skarg skarg commented Jul 27, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the BACnet AtomicReadFile (ARF) and AtomicWriteFile (AWF) confirmed-service handlers to detect when the requested access method (stream vs record) does not match the configured File object access method, and to return ERROR_CODE_INVALID_FILE_ACCESS_METHOD in that case. It also updates the unit-test stubs and test cases to provide the file access method to the handlers.

Changes:

  • Add a file-access-method consistency check to handler_atomic_write_file_encode() and handler_atomic_read_file_encode().
  • Extend the AWF/ARF unit-test bacfile stubs with bacfile_file_access_stream() plus a controllable return value.
  • Update existing AWF/ARF tests to set the stubbed access-method result to match each request type.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
src/bacnet/basic/service/h_awf.c Adds a guard that errors out when requested access method doesn’t match the File object’s access configuration.
src/bacnet/basic/service/h_arf.c Adds the same access-method mismatch guard for AtomicReadFile handling.
test/bacnet/basic/service/h_awf/src/bacfile_stub.c Adds a controllable stub for bacfile_file_access_stream() for AWF tests.
test/bacnet/basic/service/h_awf/src/main.c Sets the stubbed access method in existing AWF tests to align with the request’s access method.
test/bacnet/basic/service/h_arf/src/bacfile_stub.c Adds a controllable stub for bacfile_file_access_stream() for ARF tests.
test/bacnet/basic/service/h_arf/src/main.c Sets the stubbed access method in existing ARF tests to align with the request’s access method.

Comment thread src/bacnet/basic/service/h_awf.c
Comment thread src/bacnet/basic/service/h_arf.c
@skarg
skarg merged commit b3af4b3 into master Jul 27, 2026
36 checks passed
@skarg
skarg deleted the bugfix/ramfs-atomic-write-file-stream-method-mismatch branch July 27, 2026 21:03
skarg added a commit that referenced this pull request Aug 4, 2026
* doc: add CVE-2026-64675 to GHSA-mmg6-p4pr-cj6h advisory entry

The published advisory for GHSA-mmg6-p4pr-cj6h (pre-auth OOB read in
xy_color_decode) was assigned CVE-2026-64675, but the SECURITY.md
entry was missing the CVE link. Add it to match the published record.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* doc: add 9 draft advisory entries to SECURITY.md

Add entries for all draft GHSA advisories visible after authentication:

- GHSA-f23j-5f4w-cxhj: Command object action list resize heap use-after-free write (1.7.0-rc2, PR #1461)
- GHSA-rxvq-3mhq-474x: Cross-peer disclosure caused by a BVLC length mismatch (1.4.6/1.5.2/1.6.1/1.7.0, PR #1451)
- GHSA-9qx8-hr5x-r35c: Silent decode failure in bacnet_octet_string_decode() (1.4.6/1.5.2/1.6.1/1.7.0, PR #1440)
- GHSA-gv7j-28x8-cr37: AtomicWriteFile access-method mismatch leading to RAMFS heap OOB read (1.4.6/1.5.2/1.6.1/1.7.0, PR #1439)
- GHSA-gj7v-fwjp-7x8q: Router route-table Tx_Buffer overflow (1.4.6/1.5.2/1.6.1/1.7.0, PR #1438)
- GHSA-hg85-pmm3-jfcf: Structured View subordinate-list[0] unbounded resize DoS (1.6.1/1.7.0, PR #1437)
- GHSA-92q2-p4vr-fvmp: BACnet/SC hub never requires a client cert (1.4.6/1.5.2/1.6.1/1.7.0, PR #1436)
- GHSA-gr74-333w-7wg8: Trailing MORE bit BACnet/SC header option OOB read/write (1.4.6/1.5.2/1.6.1/1.7.0, PR #1435)
- GHSA-jgm4-2wg9-jwfg: BACnet/SC node accepts self-signed hub cert MITM (1.4.6/1.5.2/1.6.1/1.7.0, PR #1434)

None of these drafts have CVE IDs assigned yet.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants