Summary

A signed integer overflow in bacnet_enclosed_data_length() allows a crafted BACnet APDU to corrupt calculated buffer lengths and trigger heap memory corruption in applications using the vulnerable BACnet stack.

The vulnerability is reachable through multiple BACnet message decoders, including ReadProperty, ReadPropertyMultiple, WriteProperty, COV, ReadRange, and other handlers.

Details

The vulnerability exists in src/bacnet/bacdcode.c in bacnet_enclosed_data_length().

The function checks whether each individual tag.len_value_type is greater than INT_MAX, but it does not check whether the running sums overflow after adding the validated value.

The vulnerable operations include:

if (tag.len_value_type > INT_MAX) {
    /* error: length is out of range */
    return BACNET_STATUS_ERROR;
}

len += tag.len_value_type;
...
total_len += len;
...
apdu_len += len;

Although each individual length value is bounded, the cumulative values stored in the signed integer variables len, total_len, and apdu_len can exceed the maximum representable value.

A malicious BACnet APDU containing a tag with a length value near INT_MAX causes the running calculations to wrap. The resulting corrupted length values are subsequently used for buffer sizing and memory operations, resulting in heap memory corruption.

The vulnerable function is called by multiple network message decoders, including:

• rp.c
• rpm.c
• wp.c
• wpm.c
• cov.c
• readrange.c
• ptransfer.c
• list_element.c
• create_object.c
• timer_value.c

The issue is fixed by commit 84315901:

fix: prevent signed integer overflow in bacnet_enclosed_data_length() (#1468)

The fix currently exists on the maintenance branch and is not present in the bacnet-stack-1.6.0 release tag.

PoC

Build the vulnerable bacnet-stack-1.6.0 release with AddressSanitizer enabled.

Construct a BACnet APDU containing:

1. An opening tag (0x0E).
2. A context tag whose extended len_value_type encodes a value close to INT_MAX.
3. The corresponding closing tag.
4. Pass the crafted APDU to a BACnet message decoder that reaches bacnet_enclosed_data_length().

The crafted length causes the following calculations to overflow:

len += tag.len_value_type
total_len += len
apdu_len += len

Under AddressSanitizer, the resulting corrupted length is subsequently used by the affected decoding path and produces a memory-safety violation.

The vulnerable code can be reproduced directly from the bacnet-stack-1.6.0 release source.

Impact

This is a signed integer overflow leading to heap memory corruption (CWE-190).

An attacker able to supply a crafted BACnet APDU to an affected decoder can trigger the vulnerable length calculation and cause heap memory corruption in the application using bacnet-stack.

The vulnerability affects applications that process the affected BACnet message types using the vulnerable release.