Merge branch 'bacnet-stack:master' into server-uci

Author: stargieg

.gitignore

@@ -114,3 +114,4 @@ apps/piface/libpifacedigital/
 *.vcxproj.user
 .venv/
 .github/prompts
+.agents/

CHANGELOG.md

@@ -13,10 +13,41 @@ The git repositories are hosted at the following sites:
 * <https://bacnet.sourceforge.net/>
 * <https://github.com/bacnet-stack/bacnet-stack/>
 
-## [Unreleased] - 2026-05-29
+## [Unreleased] - 2026-06-29
 
 ### Security
 
+* Secured lighting_command_decode out-of-bounds read, and enforce the
+  FADE_TO and RAMP_TO required levels. (#1412)
+* Secure SCFailedConnectionRequest and SCDirectConnection decoder by
+  adjusting the apdu size calculation. (#1413)
+* Secured RAMFS by checking read-only property for file size setting
+  and zero new memory during realloc to prevent data leaking. (#1411)
+* Secured EPICs app property list management by adding append function. (#1409)
+* Secured Life Safety Zone member handling for write property. (#1410)
+* Secured the basic RAMFS to prevent buffer overrun during consecutive
+  record appends and prevent heap out-of-bounds read during record
+  replacement. (#1408)
+* Secured rpm_ack_decode_service_request buffer overflow by validating data
+  length and remaining bytes. Added unit tests for
+  handler_read_property_multiple_ack decoder paths. (#1395)
+* Secured BACnet/SC short proprietary option headers using BVLC-SC option
+  header validation and rejecting proprietary options with hdr_len < 3
+  (minimum vendor-id + option-type). Made proprietary option decode
+  initialize outputs and only read vendor-id/option-type when hdr_len >= 3.
+  Added a regression test that injects a malformed proprietary option
+  and asserts decode fails with ERROR_CODE_HEADER_ENCODING_ERROR. (#1396)
+* Secured apps/router-mstp and apps/router-ipv6 routing, introducing
+  routed_npdu_apdu_encode() with an explicit oversized-PDU drop check.
+  Fixed protocol-version access (avoid reading pdu[0] when pdu_len == 0).
+  Refactored logging in router applications to use debug_log_fprintf
+  for consistent debug output. Refactored the router apps to use the
+  bactext_debug_severity_strtol() for the BACNET_ROUTER_DEBUG environment
+  variable. (#1392)
+* Secured the network control handler in the router-ipv6 and router-mstp apps
+  to ensure proper offset calculation and prevent buffer overrun. (#1387)
+* Secured xy_color_decode() by adjusting apdu_size calculation to prevent
+  out-of-bounds read. (#1386)
 * Secured the basic device object which had a string use after free.
   Added character string buffer stndup and same/diff functions.
   Changed all the device object character string handling to use
@@ -66,6 +97,16 @@ The git repositories are hosted at the following sites:
 
 ### Added
 
+* Added .github/prompts to .gitignore
+* Add debug severity handling with ASCII string conversion functions into
+  bactext module. Changed all the example apps to use the
+  bactext_debug_severity_strtol() function for the "--debug" command
+  line argument. (#1393)
+* Added Lighting_Output_Overridden_Ramp function. (#1389)
+* Added a lighting command override ramp function. Refactored the lighting
+  commands to prevent them from meddling with tracking values and lighting
+  operations while the light is overridden. (#1388)
+* Added BACNET_DEFINES variable to CMake build. (#1384)
 * Added BACnet/SC (BSC) datalink support to the modbus-gateway application.
   Extended GW_CONFIG with sc sub-struct holding all BACNET_SC_* fields, and
   added compile-time fallback: non-BSC binary + "bsc" JSON → warns and falls
@@ -115,6 +156,32 @@ The git repositories are hosted at the following sites:
 
 ### Changed
 
+* Changed the GTK discover app to refresh objects quickly. Fixed object
+  tree view to update a single row in place, preserving the selection.
+  Implemented property value editing with Enter key commit control for
+  WriteProperty. Refactored main window layout and default window size
+  and column spacing constants for better usability. Removed REFRESH
+  button. (#1390)
+* Changed compiler warnings to be stricter and remove unnecessary suppressions.
+  Apply const correctness across multiple files, including datalink interface
+  name parameters across multiple files. Apply const qualifications to the
+  character buffer string functions. Apply const correctness to string
+  parameters in bacapp.c and bacapp.h. Revise parsing of const strings using
+  bacnet_stptok() to tokenize. Add bacnet_strncpy to ensure null-terminated
+  partial string copying. Replace strncpy with bacnet_strncpy for safer string
+  copying in modbus_rtu and point_table modules. Fixed file compile warnings
+  where the "no previous declaration" is being generated. Fixed floating-point
+  arithmetic by adding type casts for clarity, including a changing
+  color_rgb_clamp to use float instead of double to fix compiler float
+  conversion warnings. Refactor hostname validation and encoding functions
+  for const correctness and improved string handling.
+  Renamed routed_get_my_address to Routed_Device_Get_My_Address and
+  update references for consistency with BAC_ROUTING.
+  Refactor Ringbuf functions to remove unnecessary volatile qualifiers
+  and casting to improve type safety. Use cast to uintptr_t for specific
+  casting to const where appropriate. Enable additional compiler warnings
+  in unit tests and treat them as errors to enforce clean builds.
+  Add parse_primitive_value function to handle primitive data parsing. (#1385)
 * Changed debug_print to debug_log_fprintf in ReadRange handler. (#1303)
 * Changed logging in many modules to use debug_log_fprintf for consistent
   error and debug output that can be adjusted during runtime. (#1364)
@@ -150,6 +217,17 @@ The git repositories are hosted at the following sites:
 
 ### Fixed
 
+* Fixed out-of-bounds write in Read Property ACK closing tag encoding. (#1407)
+* Fixed AV COV change on out-of-service writes by marking them. (#1406)
+* Fixed GetEventInformation service choice in error reply. (#1405)
+* Fixed device object property value codec by  advancing cursor. (#1404)
+* Fixed Recipient_List decode by advancing the cursor for list elements. (#1402)
+* Fixed GetAlarmSummary to accept empty request. (#1401)
+* Fixed Binary_Lighting_Output_Create to initialize Time_Of_Active_Time_Reset
+  and Time_Of_Strike_Count_Reset using datetime_wildcard_set.
+* Fixed access credential object initialization to use datetime_wildcard_set
+  for activation and expiration times.
+* Fixed C89 build warnings from modbus gateway application. (#1383)
 * Fixed ReadRange service request to reject for missing mandatory parameters
   in Read Range request. (#1303)
 * Fixed BACnet/SC primary hub reconnection logic when connected to failover
@@ -204,6 +282,8 @@ The git repositories are hosted at the following sites:
 
 ### Removed
 
+* Remove unnecessary LEGACY=true flag from build commands in Makefile,
+ workflows, and scripts. (#1383)
 * Removed unmaintained ports/uip, ports/arduino_uno, ports/pic18*,
   and ports/rx62n folders and references. (#1324)
 

apps/epics/main.c

@@ -112,6 +112,24 @@ static uint32_t Property_List_Length = 0;
 static uint32_t Property_List_Index = 0;
 static int32_t Property_List[MAX_PROPS + 2];
 
+static bool property_list_append(int32_t property_id)
+{
+    uint32_t capacity =
+        (uint32_t)(sizeof(Property_List) / sizeof(Property_List[0]));
+
+    /* Keep one slot free for the list terminator and cap to MAX_PROPS. */
+    if ((Property_List_Index >= (capacity - 1)) ||
+        (Property_List_Index >= MAX_PROPS)) {
+        return false;
+    }
+
+    Property_List[Property_List_Index] = property_id;
+    Property_List_Index++;
+    Property_List_Length++;
+
+    return true;
+}
+
 struct property_value_list_t {
     int32_t property_id;
     BACNET_APPLICATION_DATA_VALUE *value;
@@ -842,10 +860,11 @@ ProcessRPMData(BACNET_READ_ACCESS_DATA *rpm_data, EPICS_STATES state)
                         bHasStructuredViewList = true;
                         break;
                     default:
-                        Property_List[Property_List_Index] =
-                            rpm_property->propertyIdentifier;
-                        Property_List_Index++;
-                        Property_List_Length++;
+                        if (!property_list_append(
+                                (int32_t)rpm_property->propertyIdentifier)) {
+                            /* Ignore excess properties once local list is full.
+                             */
+                        }
                         break;
                 }
                 /* Free up the value(s) */
@@ -905,18 +924,24 @@ ProcessRPMData(BACNET_READ_ACCESS_DATA *rpm_data, EPICS_STATES state)
     } else if (bSuccess) { /* and GET_LIST_OF_ALL_RESPONSE */
         /* Now append the properties we waited on. */
         if (bHasStructuredViewList) {
-            Property_List[Property_List_Index] = PROP_STRUCTURED_OBJECT_LIST;
-            Property_List_Index++;
-            Property_List_Length++;
+            if (!property_list_append(PROP_STRUCTURED_OBJECT_LIST)) {
+                /* Ignore when local list is full. */
+            }
         }
         if (bHasObjectList) {
-            Property_List[Property_List_Index] = PROP_OBJECT_LIST;
-            Property_List_Index++;
-            Property_List_Length++;
+            if (!property_list_append(PROP_OBJECT_LIST)) {
+                /* Ignore when local list is full. */
+            }
         }
         /* Now insert the -1 list terminator, but don't count it. */
-        Property_List[Property_List_Index] = -1;
-        assert(Property_List_Length < MAX_PROPS);
+        if (Property_List_Index <
+            (uint32_t)(sizeof(Property_List) / sizeof(Property_List[0]))) {
+            Property_List[Property_List_Index] = -1;
+        } else {
+            Property_List
+                [(sizeof(Property_List) / sizeof(Property_List[0])) - 1] = -1;
+        }
+        assert(Property_List_Length <= MAX_PROPS);
         Property_List_Index = 0; /* Will start at top of the list */
         nextState = GET_PROPERTY_REQUEST;
     }

src/bacnet/bacapp.c

@@ -6162,6 +6162,9 @@ int bacapp_device_object_property_value_encode(
     if (value->property_array_index != BACNET_ARRAY_ALL) {
         len = encode_context_unsigned(apdu, 3, value->property_array_index);
         apdu_len += len;
+        if (apdu) {
+            apdu += len;
+        }
     }
     len = encode_opening_tag(apdu, 4);
     apdu_len += len;
@@ -6263,7 +6266,8 @@ int bacapp_device_object_property_value_decode(
             value->property_array_index = BACNET_ARRAY_ALL;
         }
     }
-    if (bacnet_is_opening_tag_number(apdu, apdu_size, 4, &len)) {
+    if (bacnet_is_opening_tag_number(
+            &apdu[apdu_len], apdu_size - apdu_len, 4, &len)) {
         /* property-value [4] ABSTRACT-SYNTAX.&Type */
         apdu_len += len;
         if (value) {
@@ -6276,11 +6280,14 @@ int bacapp_device_object_property_value_decode(
         } else {
             return BACNET_STATUS_ERROR;
         }
-        if (bacnet_is_closing_tag_number(apdu, apdu_size, 4, &len)) {
+        if (bacnet_is_closing_tag_number(
+                &apdu[apdu_len], apdu_size - apdu_len, 4, &len)) {
             apdu_len += len;
         } else {
             return BACNET_STATUS_ERROR;
         }
+    } else {
+        return BACNET_STATUS_ERROR;
     }
 
     return apdu_len;

src/bacnet/basic/object/av.c

@@ -993,7 +993,8 @@ bool Analog_Value_Write_Property(BACNET_WRITE_PROPERTY_DATA *wp_data)
             status = write_property_type_valid(
                 wp_data, &value, BACNET_APPLICATION_TAG_BOOLEAN);
             if (status) {
-                CurrentAV->Out_Of_Service = value.type.Boolean;
+                Analog_Value_Out_Of_Service_Set(
+                    wp_data->object_instance, value.type.Boolean);
             }
             break;
         case PROP_UNITS:

src/bacnet/basic/object/bacfile.c

@@ -649,9 +649,11 @@ bool bacfile_file_size_set(
 
     pObject = Keylist_Data(Object_List, object_instance);
     if (pObject) {
-        if (pObject->File_Access_Stream) {
-            status =
-                bacfile_file_size_set_callback(pObject->Pathname, file_size);
+        if (!pObject->Read_Only) {
+            if (pObject->File_Access_Stream) {
+                status = bacfile_file_size_set_callback(
+                    pObject->Pathname, file_size);
+            }
         }
     }