Skip to content

Fix DoS vulnerability in rpm_decode_object_property for malformed RPM requests#1374

Merged
skarg merged 1 commit into
masterfrom
bugfix/rpm-malformed-request-infinite-loop
Jun 3, 2026
Merged

Fix DoS vulnerability in rpm_decode_object_property for malformed RPM requests#1374
skarg merged 1 commit into
masterfrom
bugfix/rpm-malformed-request-infinite-loop

Conversation

@skarg
Copy link
Copy Markdown
Collaborator

@skarg skarg commented Jun 2, 2026

No description provided.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses a denial-of-service condition in the ReadPropertyMultiple (RPM) request handling path by ensuring rpm_decode_object_property() returns a negative error when invoked with an exhausted buffer, preventing an infinite loop in handler_read_property_multiple on malformed/truncated requests.

Changes:

  • Update rpm_decode_object_property() to reject calls where apdu == NULL or apdu_size == 0 (returning BACNET_STATUS_REJECT and setting an appropriate reject error code).
  • Add a regression test that constructs an RPM request missing the closing tag and asserts the decoder returns a negative error once the buffer is exhausted.
  • Register the new regression test in the RPM test suite (legacy ztest API path).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
src/bacnet/rpm.c Prevents zero-length decode from returning 0, eliminating the infinite-loop/CPU spin condition on malformed RPM requests.
test/bacnet/rpm/src/main.c Adds/ registers a regression test covering the malformed RPM “missing closing tag” scenario to prevent reintroduction of the DoS.

@skarg skarg merged commit 48ed1ae into master Jun 3, 2026
37 checks passed
@skarg skarg deleted the bugfix/rpm-malformed-request-infinite-loop branch June 3, 2026 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants