Skip to content

Channel member self-reference causes uncontrolled recursion#1345

Merged
skarg merged 3 commits into
masterfrom
bugfix/channel-member-self-reference-uncontrolled-recursion
May 13, 2026
Merged

Channel member self-reference causes uncontrolled recursion#1345
skarg merged 3 commits into
masterfrom
bugfix/channel-member-self-reference-uncontrolled-recursion

Conversation

@skarg
Copy link
Copy Markdown
Collaborator

@skarg skarg commented May 12, 2026

PROP_LIST_OF_OBJECT_PROPERTY_REFERENCES accepts a self-referential entry pointing back to the same Channel object's PROP_PRESENT_VALUE. A subsequent WriteProperty request to that Channel object's PROP_PRESENT_VALUE causes the implementation to re-expand the persisted member reference through the internal Device_Write_Property callback, creating an unbounded recursive loop:

Channel_Write_Property -> Channel_Present_Value_Write -> Channel_Write_Members -> Device_Write_Property -> Channel_Write_Property -> ...

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the Channel object against unbounded recursive writes caused by self-referential entries in PROP_LIST_OF_OBJECT_PROPERTY_REFERENCES, preventing WriteProperty(PROP_PRESENT_VALUE) from re-entering the Channel write path indefinitely.

Changes:

  • Adds a re-entrancy guard in Channel_Write_Members() using Write_Status to stop recursive member expansion.
  • Rejects direct self-references to the same Channel’s PROP_PRESENT_VALUE when writing PROP_LIST_OF_OBJECT_PROPERTY_REFERENCES.
  • Refactors array-element decoding for PROP_LIST_OF_OBJECT_PROPERTY_REFERENCES and PROP_CONTROL_GROUPS to use type-specific decoders and clearer error mapping.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/bacnet/basic/object/channel.c
@skarg skarg merged commit 343a742 into master May 13, 2026
36 checks passed
@skarg skarg deleted the bugfix/channel-member-self-reference-uncontrolled-recursion branch May 13, 2026 18:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants