diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f998c7dae..9484858fac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,16 @@ The git repositories are hosted at the following sites:
*
*
-## [Unreleased] - 2026-06-29
+## [1.6.1] - Unreleased
+
+### Security
+
+* Secured an MS/TP implementation COBS frame decoding buffer overflow,
+ and added unit test for tight buffer handling. (#1425)
+
+### Fixed
+
+## [1.6.0] - 2026-07-04
### Security
diff --git a/CMakeLists.txt b/CMakeLists.txt
index e08cb25169..8b79b650cd 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.5 FATAL_ERROR)
project(
bacnet-stack
- VERSION 1.6.0
+ VERSION 1.6.1
LANGUAGES C)
#
diff --git a/SECURITY.md b/SECURITY.md
index b01f626987..6eb18b3359 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -3,22 +3,11 @@
## Supported Versions
The following versions of the BACnet Stack C library are
-currently being supported with security updates.
+currently being supported with security updates in this branch:
| Version | Supported |
| ------- | ------------------ |
| 1.6.x | :white_check_mark: |
-| 1.5.x | :white_check_mark: |
-| 1.4.x | :white_check_mark: |
-| 1.3.x | :x: |
-| 1.2.x | :x: |
-| 1.1.x | :x: |
-| 1.0.x | :x: |
-| 0.9.x | :x: |
-| 0.8.x | :x: |
-| 0.7.x | :x: |
-| < 0.6.x | :x: |
-
## Coordinated Vulnerability Disclosure
@@ -27,238 +16,169 @@ or [GHSA](https://github.com/bacnet-stack/bacnet-stack/security/advisories)
and a record is created to identify, define, and catalog publicly disclosed
cybersecurity vulnerabilities.
-Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)
-[GHSA-9hq3-w3pc-8385](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
-Pull Request: [#1412](https://github.com/bacnet-stack/bacnet-stack/pull/1412).
+MS/TP COBS decode overflow
+[GHSA-8456-m9x4-j6mc](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8456-m9x4-j6mc).
+Patched versions: 1.6.1
+Pull Request: [#1425](https://github.com/bacnet-stack/bacnet-stack/pull/1425).
-WriteProperty(File_Size) can bypass read-only protection and expose uninitialized RAMFS tail bytes through AtomicReadFile
-[GHSA-mwj7-2v5r-v934](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mwj7-2v5r-v934).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
-Pull Request: [#1411](https://github.com/bacnet-stack/bacnet-stack/pull/1411).
+[CVE-2026-52790](https://www.cve.org/CVERecord?id=CVE-2026-52790) -
+bacnet_device.c stack-use-after-return in writable Device string properties
+[GHSA-jr7p-rm2x-739x](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x).
+Patched versions: 1.6.0
+Pull Request: [#1375](https://github.com/bacnet-stack/bacnet-stack/pull/1375).
+
+[CVE-2026-45341](https://www.cve.org/CVERecord?id=CVE-2026-45341) -
+WriteProperty to Structured View subordinate-list causes NULL pointer dereference
+[GHSA-fv2r-c2m2-7qhh](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-fv2r-c2m2-7qhh)
+Patched versions: 1.6.0
+Pull Request: [#1321](https://github.com/bacnet-stack/bacnet-stack/pull/1321).
+
+Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
+[GHSA-mmg6-p4pr-cj6h](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h).
+Patched versions: 1.6.0
+Pull Request: [#1386](https://github.com/bacnet-stack/bacnet-stack/pull/1386),
+[#1387](https://github.com/bacnet-stack/bacnet-stack/pull/1387).
+
+[CVE-2026-58498](https://www.cve.org/CVERecord?id=CVE-2026-58498) -
+Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path
+[GHSA-4p4w-m434-jrhj](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4p4w-m434-jrhj).
+Patched versions: 1.6.0
+Pull Request: [#1392](https://github.com/bacnet-stack/bacnet-stack/pull/1392).
+
+[CVE-2026-62973](https://www.cve.org/CVERecord?id=CVE-2026-62973) -
+Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK
+[GHSA-3xxw-jfwm-rq9c](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c).
+Patched versions: 1.6.0
+Pull Request: [#1395](https://github.com/bacnet-stack/bacnet-stack/pull/1395).
+[CVE-2026-62975](https://www.cve.org/CVERecord?id=CVE-2026-62975) -
Replacing a RAMFS record with a shorter one via AtomicWriteFile(record-access) can trigger a heap out-of-bounds read
[GHSA-cf8g-hp9m-9fvv](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cf8g-hp9m-9fvv).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1408](https://github.com/bacnet-stack/bacnet-stack/pull/1408).
+[CVE-2026-62976](https://www.cve.org/CVERecord?id=CVE-2026-62976) -
Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend
[GHSA-32jj-x86x-w98w](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-32jj-x86x-w98w).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1408](https://github.com/bacnet-stack/bacnet-stack/pull/1408).
+[CVE-2026-62974](https://www.cve.org/CVERecord?id=CVE-2026-62974) -
Remote unauthenticated DoS in Life_Safety_Zone PROP_ZONE_MEMBERS WriteProperty parsing
[GHSA-2c8x-f46r-8phh](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2c8x-f46r-8phh).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1410](https://github.com/bacnet-stack/bacnet-stack/pull/1410).
-Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK
-[GHSA-3xxw-jfwm-rq9c](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-3xxw-jfwm-rq9c).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
-Pull Request: [#1395](https://github.com/bacnet-stack/bacnet-stack/pull/1395).
-
-Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path
-[GHSA-4p4w-m434-jrhj](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4p4w-m434-jrhj).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
-Pull Request: [#1392](https://github.com/bacnet-stack/bacnet-stack/pull/1392).
-
-[CVE-2026-58265](https://www.cve.org/CVERecord?id=CVE-2026-58265) -
-Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)
-[GHSA-j66x-fr38-r7m5](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-j66x-fr38-r7m5).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
-Pull Request: [#1396](https://github.com/bacnet-stack/bacnet-stack/pull/1396).
-
-Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
-[GHSA-mmg6-p4pr-cj6h](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mmg6-p4pr-cj6h).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
-Pull Request: [#1386](https://github.com/bacnet-stack/bacnet-stack/pull/1386),
-[#1387](https://github.com/bacnet-stack/bacnet-stack/pull/1387).
+[CVE-2026-62977](https://www.cve.org/CVERecord?id=CVE-2026-62977) -
+WriteProperty(File_Size) can bypass read-only protection and expose uninitialized RAMFS tail bytes through AtomicReadFile
+[GHSA-mwj7-2v5r-v934](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-mwj7-2v5r-v934).
+Patched versions: 1.6.0
+Pull Request: [#1411](https://github.com/bacnet-stack/bacnet-stack/pull/1411).
-[CVE-2026-52790](https://www.cve.org/CVERecord?id=CVE-2026-52790) -
-bacnet_device.c stack-use-after-return in writable Device string properties
-[GHSA-jr7p-rm2x-739x](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-jr7p-rm2x-739x).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
-Pull Request: [#1375](https://github.com/bacnet-stack/bacnet-stack/pull/1375).
+[CVE-2026-62972](https://www.cve.org/CVERecord?id=CVE-2026-62972) -
+Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)
+[GHSA-9hq3-w3pc-8385](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9hq3-w3pc-8385).
+Patched versions: 1.6.0
+Pull Request: [#1412](https://github.com/bacnet-stack/bacnet-stack/pull/1412).
[CVE-2026-52789](https://www.cve.org/CVERecord?id=CVE-2026-52789) -
Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests.
[GHSA-4rf9-4vgq-5gcw](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4rf9-4vgq-5gcw).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1374](https://github.com/bacnet-stack/bacnet-stack/pull/1374).
[CVE-2026-52788](https://www.cve.org/CVERecord?id=CVE-2026-52788) -
Buffer overflows in bsc_node_parse_urls() (BACnet/SC Address Resolution ACK URL parser).
[GHSA-rf83-3rr5-v4mj](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rf83-3rr5-v4mj).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1365](https://github.com/bacnet-stack/bacnet-stack/pull/1365).
[CVE-2026-52786](https://www.cve.org/CVERecord?id=CVE-2026-52786) -
apps/epics: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData().
[GHSA-c4q6-7827-mfg6](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-c4q6-7827-mfg6).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1366](https://github.com/bacnet-stack/bacnet-stack/pull/1366),
[#1409](https://github.com/bacnet-stack/bacnet-stack/pull/1409).
[CVE-2026-52787](https://www.cve.org/CVERecord?id=CVE-2026-52787) -
Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()
[GHSA-4fgg-fghm-jm43](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4fgg-fghm-jm43).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1363](https://github.com/bacnet-stack/bacnet-stack/pull/1363).
[CVE-2026-49990](https://www.cve.org/CVERecord?id=CVE-2026-49990) -
AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends.
[GHSA-8759-hx7g-94qx](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8759-hx7g-94qx).
-Patched versions: 1.4.5, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1362](https://github.com/bacnet-stack/bacnet-stack/pull/1362).
[CVE-2026-47710](https://www.cve.org/CVERecord?id=CVE-2026-47710) -
Loop reference to long Structured View description causes stack-buffer-overflow.
[GHSA-2xm5-gjpc-9m6q](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2xm5-gjpc-9m6q).
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1355](https://github.com/bacnet-stack/bacnet-stack/pull/1355).
[CVE-2026-47711](https://www.cve.org/CVERecord?id=CVE-2026-47711) -
Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone accepted-modes property.
[GHSA-vrpm-9gm2-x552](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-vrpm-9gm2-x552).
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1354](https://github.com/bacnet-stack/bacnet-stack/pull/1354),
[#1355](https://github.com/bacnet-stack/bacnet-stack/pull/1355).
[CVE-2026-47259](https://www.cve.org/CVERecord?id=CVE-2026-47259) -
Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding.
[GHSA-9w9m-w7w5-rrv3](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-9w9m-w7w5-rrv3).
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1353](https://github.com/bacnet-stack/bacnet-stack/pull/1353).
[CVE-2026-47258](https://www.cve.org/CVERecord?id=CVE-2026-47258) -
Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding.
[GHSA-rjmv-3mcm-r83j](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rjmv-3mcm-r83j).
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1353](https://github.com/bacnet-stack/bacnet-stack/pull/1353).
[CVE-2026-47257](https://www.cve.org/CVERecord?id=CVE-2026-47257) -
ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success.
[GHSA-x6pp-3pf3-f87r](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-x6pp-3pf3-f87r).
-Patched versions: 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1352](https://github.com/bacnet-stack/bacnet-stack/pull/1352).
[CVE-2026-49341](https://www.cve.org/CVERecord?id=CVE-2026-49341) -
Uncontrolled recursion in Timer object writeback path leads to remote server stack overflow.
[GHSA-7r8r-2rj2-5wvr](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7r8r-2rj2-5wvr).
-Patched versions: 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1347](https://github.com/bacnet-stack/bacnet-stack/pull/1347)
[CVE-2026-47217](https://www.cve.org/CVERecord?id=CVE-2026-47217) -
-Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server.
-[GHSA-wjw5-q9g6-2764](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-wjw5-q9g6-2764).
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server
+[GHSA-wjw5-q9g6-2764](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-wjw5-q9g6-2764)
+Patched versions: 1.6.0
Pull Request: [#1345](https://github.com/bacnet-stack/bacnet-stack/pull/1345).
[CVE-2026-46677](https://www.cve.org/CVERecord?id=CVE-2026-46677) -
-Client-Side Out-of-Bounds Read in AtomicReadFile-ACK Record-Access Handling via RecordCount / fileData[] Mismatch.
-[GHSA-rv5h-cxwq-q3mh](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rv5h-cxwq-q3mh).
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Client-Side Out-of-Bounds Read in AtomicReadFile-ACK Record-Access Handling via RecordCount / fileData[] Mismatch
+[GHSA-rv5h-cxwq-q3mh](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rv5h-cxwq-q3mh)
+Patched versions: 1.6.0
Pull Request: [#1344](https://github.com/bacnet-stack/bacnet-stack/pull/1344).
[CVE-2026-46676](https://www.cve.org/CVERecord?id=CVE-2026-46676) -
Uninitialized Value Use in AtomicReadFile-ACK Record-Access Encoder Causes Response Corruption and Conditional Information Disclosure
[GHSA-2fwp-32cj-g3x4](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-2fwp-32cj-g3x4)
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1344](https://github.com/bacnet-stack/bacnet-stack/pull/1344).
[CVE-2026-46674](https://www.cve.org/CVERecord?id=CVE-2026-46674) -
Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount
[GHSA-8384-pwhh-cxjh](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8384-pwhh-cxjh)
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1344](https://github.com/bacnet-stack/bacnet-stack/pull/1344).
-[CVE-2026-45341](https://www.cve.org/CVERecord?id=CVE-2026-45341) -
-WriteProperty to Structured View subordinate-list causes NULL pointer dereference
-[GHSA-fv2r-c2m2-7qhh](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-fv2r-c2m2-7qhh)
-Patched versions: 1.4.4, 1.5.1, 1.6.0
-Pull Request: [#1321](https://github.com/bacnet-stack/bacnet-stack/pull/1321).
-
[CVE-2026-45265](https://www.cve.org/CVERecord?id=CVE-2026-45265) -
Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write
[GHSA-v3gx-mwrp-xvh5](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-v3gx-mwrp-xvh5)
-Patched versions: 1.4.4, 1.5.1, 1.6.0
+Patched versions: 1.6.0
Pull Request: [#1340](https://github.com/bacnet-stack/bacnet-stack/pull/1340).
-[CVE-2026-40279](https://www.cve.org/CVERecord?id=CVE-2026-40279) -
-Undefined-behavior signed left shift in `decode_signed32()`
-[GHSA-326g-j95f-gmxv](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv)
-Patched versions: 1.5.0, 1.4.3
-Pull Request: [#1300](https://github.com/bacnet-stack/bacnet-stack/pull/1300)
-
-[CVE-2026-41503](https://www.cve.org/CVERecord?id=CVE-2026-41503) -
-Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser
-[GHSA-5w2v-mwqj-pr2c](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-5w2v-mwqj-pr2c)
-Patched versions: 1.5.0, 1.4.3
-Pull Request:
-[#1244](https://github.com/bacnet-stack/bacnet-stack/pull/1244)
-
-[CVE-2026-41502](https://www.cve.org/CVERecord?id=CVE-2026-41502) -
-Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder
-[GHSA-7545-3fpx-4xw3](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7545-3fpx-4xw3)
-Patched versions: 1.5.0, 1.4.3
-Pull Request:
-[#1244](https://github.com/bacnet-stack/bacnet-stack/pull/1244)
-
-[CVE-2026-41475](https://www.cve.org/CVERecord?id=CVE-2026-41475) -
-Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser
-[GHSA-cvv4-v3g6-4jmv](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-cvv4-v3g6-4jmv)
-Patched versions: 1.5.0, 1.4.3
-Pull Request:
-[#1244](https://github.com/bacnet-stack/bacnet-stack/pull/1244)
-
-[CVE-2026-26264](https://www.cve.org/CVERecord?id=CVE-2026-26264) -
-WriteProperty decoding length underflow leads to OOB read and crash
-[GHSA-phjh-v45p-gmjj](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-phjh-v45p-gmjj)
-Patched versions: 1.5.0, 1.4.3
-Pull Request:
-[#1231](https://github.com/bacnet-stack/bacnet-stack/pull/1231)
-
-[CVE-2026-21870](https://www.cve.org/CVERecord?id=CVE-2026-21870) -
-Off-by-one Stack-based Buffer Overflow in tokenizer_string
-[GHSA-pc83-wp6w-93mx](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-pc83-wp6w-93mx)
-Patched versions: 1.5.0, 1.4.3
-Pull Request:
-[#1196](https://github.com/bacnet-stack/bacnet-stack/pull/1196)
-
-[CVE-2026-21878](https://www.cve.org/CVERecord?id=CVE-2026-21878) -
-Improper Limitation of a Pathname to a Restricted Directory
-[GHSA-p8rx-c26w-545j](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-p8rx-c26w-545j)
-Patched versions: 1.5.0
-Pull Request:
-[#1197](https://github.com/bacnet-stack/bacnet-stack/pull/1197)
-
-[CVE-2025-66624](https://www.cve.org/CVERecord?id=CVE-2025-66624) -
-BACnet-stack MS/TP reply matcher OOB read
-[GHSA-8wgw-5h6x-qgqg](https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-8wgw-5h6x-qgqg)
-Patched versions: 1.5.0
-Pull Request:
-[#1178](https://github.com/bacnet-stack/bacnet-stack/pull/1178)
-
-[CVE-2023-38341](https://www.cve.org/CVERecord?id=CVE-2023-38341) -
-Multiple out-of-bounds accesses in bacerror code paths
-[#81](https://sourceforge.net/p/bacnet/bugs/81/)
-
-[CVE-2023-38340](https://www.cve.org/CVERecord?id=CVE-2023-38340) -
-Out of bounds accesses in bacnet_npdu_decode
-[#80](https://sourceforge.net/p/bacnet/bugs/80/)
-
-[CVE-2023-38339](https://www.cve.org/CVERecord?id=CVE-2023-38339) -
-Out of bounds jump in h_apdu.c:apdu_handler
-[#79](https://sourceforge.net/p/bacnet/bugs/79/)
-
-[CVE-2019-12480](https://www.cve.org/CVERecord?id=CVE-2019-12480) -
-Invalid read in bacserv when decoding alarm tags
-[#62](https://sourceforge.net/p/bacnet/bugs/62/)
-
-[CVE-2018-10238](https://www.cve.org/CVERecord?id=CVE-2018-10238) -
-Segmentation fault leading to denial of service
-[#61](https://sourceforge.net/p/bacnet/bugs/61/)
-
## Reporting a Vulnerability
Privately discuss, fix, and publish information about security
diff --git a/release.sh b/release.sh
index 4d01ffc6db..7283107462 100755
--- a/release.sh
+++ b/release.sh
@@ -6,9 +6,8 @@
#
# Prior to running this script, be sure to:
# a) update CHANGELOG, version.h and CMakeLists.txt with new version number
-# b) commit changes into master branch
+# b) commit changes into this bacnet-stack-1.6 branch
# After running this script, be sure to:
-# c) create long term branch as bacnet-stack-x.y if needed
# d) push tags and branch to github
# e) mirror github to sourceforge using mirror.sh script
diff --git a/src/bacnet/datalink/mstp.c b/src/bacnet/datalink/mstp.c
index b83cda2215..51b705883d 100644
--- a/src/bacnet/datalink/mstp.c
+++ b/src/bacnet/datalink/mstp.c
@@ -561,8 +561,8 @@ void MSTP_Receive_Frame_FSM(struct mstp_port_struct_t *mstp_port)
(mstp_port->FrameType <= Nmax_COBS_type)) {
mstp_port->DataLength = cobs_frame_decode(
&mstp_port->InputBuffer[mstp_port->Index + 1],
- mstp_port->InputBufferSize, mstp_port->InputBuffer,
- mstp_port->Index + 1);
+ mstp_port->InputBufferSize - (mstp_port->Index + 1),
+ mstp_port->InputBuffer, mstp_port->Index + 1);
if (mstp_port->DataLength > 0) {
/* GoodCRC */
if (mstp_port->receive_state ==
diff --git a/src/bacnet/version.h b/src/bacnet/version.h
index 86ebe2ed36..af5d8ec8ed 100644
--- a/src/bacnet/version.h
+++ b/src/bacnet/version.h
@@ -15,8 +15,8 @@
#define BACNET_VERSION(x, y, z) (((x) << 16) + ((y) << 8) + (z))
#endif
-#define BACNET_VERSION_TEXT "1.6.0-rc2"
-#define BACNET_VERSION_CODE BACNET_VERSION(1, 6, 0)
+#define BACNET_VERSION_TEXT "1.6.1-rc1"
+#define BACNET_VERSION_CODE BACNET_VERSION(1, 6, 1)
#define BACNET_VERSION_MAJOR ((BACNET_VERSION_CODE >> 16) & 0xFF)
#define BACNET_VERSION_MINOR ((BACNET_VERSION_CODE >> 8) & 0xFF)
#define BACNET_VERSION_MAINTENANCE (BACNET_VERSION_CODE & 0xFF)
diff --git a/test/bacnet/datalink/mstp/src/main.c b/test/bacnet/datalink/mstp/src/main.c
index 362fa00123..a61cb5267b 100644
--- a/test/bacnet/datalink/mstp/src/main.c
+++ b/test/bacnet/datalink/mstp/src/main.c
@@ -646,6 +646,66 @@ static void testMasterNodeFSM(void)
/* FIXME: write a unit test for the Master Node State Machine */
}
+static void testReceiveNodeFSM_COBS_Decode_TightBuffer(void)
+{
+ struct mstp_port_struct_t mstp_port = { 0 }; /* port data */
+ uint8_t my_mac = 0x05; /* local MAC address */
+ uint8_t frame[MAX_MPDU] = { 0 };
+ uint8_t rx_tight[MAX_MPDU] = { 0 };
+ uint8_t payload[64] = { 0 };
+ unsigned len;
+ unsigned cobs_len;
+ unsigned tight_size;
+ unsigned guard_start;
+ unsigned i;
+
+ for (i = 0; i < sizeof(payload); i++) {
+ payload[i] = (uint8_t)(i + 1);
+ }
+ /* Include zeros to force multiple COBS blocks and real decode writes. */
+ payload[3] = 0;
+ payload[17] = 0;
+
+ len = MSTP_Create_Frame(
+ frame, sizeof(frame), FRAME_TYPE_BACNET_EXTENDED_DATA_EXPECTING_REPLY,
+ my_mac, my_mac, payload, sizeof(payload));
+ zassert_true(len > 0, NULL);
+
+ cobs_len = (((unsigned)frame[5]) << 8) | frame[6];
+ cobs_len += 2;
+ tight_size = cobs_len + 1;
+ zassert_true(tight_size < sizeof(rx_tight), NULL);
+
+ mstp_port.InputBuffer = &rx_tight[0];
+ mstp_port.InputBufferSize = tight_size;
+ mstp_port.OutputBuffer = &TxBuffer[0];
+ mstp_port.OutputBufferSize = sizeof(TxBuffer);
+ mstp_port.SilenceTimer = Timer_Silence;
+ mstp_port.SilenceTimerReset = Timer_Silence_Reset;
+ mstp_port.This_Station = my_mac;
+ mstp_port.Nmax_info_frames = 1;
+ mstp_port.Nmax_master = 127;
+ MSTP_Init(&mstp_port);
+
+ guard_start = tight_size;
+ for (i = guard_start; i < (guard_start + 8); i++) {
+ rx_tight[i] = 0xA5;
+ }
+
+ Load_Input_Buffer(frame, len);
+ for (i = 0; i < len; i++) {
+ RS485_Check_UART_Data(&mstp_port);
+ MSTP_Receive_Frame_FSM(&mstp_port);
+ }
+
+ zassert_true(mstp_port.ReceivedInvalidFrame == true, NULL);
+ zassert_true(mstp_port.ReceivedValidFrame == false, NULL);
+ zassert_true(mstp_port.receive_state == MSTP_RECEIVE_STATE_IDLE, NULL);
+ for (i = guard_start; i < (guard_start + 8); i++) {
+ zassert_true(rx_tight[i] == 0xA5, NULL);
+ }
+}
+
static void testSlaveNodeFSM(void)
{
struct mstp_port_struct_t MSTP_Port = { 0 }; /* port data */
@@ -1367,6 +1427,7 @@ void test_main(void)
{
ztest_test_suite(
crc_tests, ztest_unit_test(testReceiveNodeFSM),
+ ztest_unit_test(testReceiveNodeFSM_COBS_Decode_TightBuffer),
ztest_unit_test(testMasterNodeFSM), ztest_unit_test(testSlaveNodeFSM),
ztest_unit_test(testZeroConfigNodeFSM),
ztest_unit_test(testAutoBaudNodeFSM));