BACnet message is processing infinitely

[lubomir-mitev]

BACnet version - 6.0.0.

We found that a message received from the bacnet4j leads to it's infinitely processing. This mean high CPU and no more communication with the devices. This is the log information:
Received NPDU from [a,23,d4,e6,ba,c2]: NPDU [from=Address [networkNumber=0, macAddress=[a,23,d4,f,ba,c2]], linkService=null, queue=[10,4,9,7,1a,2,2,2e,0,0,0,5,0,0,0,20,1,b0,c8,6,0,0,0,2,0,3,a9,84,0,0,0,b,5e,d,9f,83,0,54,43,ae,0,0,0,7,f,ae,1,b0,38,3,10,0,0,0,40,45,ff,f0,0,f,b7,1,b0,50,2,10,0,0,0,20,0,0,0,1,f,fb,1,b0,50,3,10,0,0,0,40,42,87,0,0,f,fc,1,b0,50,4,10,0,0,0,20,0,0,0,3,f,fd,1,b0,50,5,10,0,0,0,40,42,c8,0,0,f,fe,1,b0,50,6,10,0,0,0,20,0,0,0,7,f,a0,1,b0,e8,d,10,0,0,0,20,0,0,0,3,2f]]

We created simple test - APDU with this queue. It's UnconfirmedRequest and when DefaultTransport invokes the method parseServiceData(), it never finish processing the data.

I don't know the BACnet device and also I don't know if the payload is correct or not. But the library must not process a message infinitely and must not stop the communications with the devices.

[terrypacker]

@lubomir-mitev can you provide your test code here? That will save time and I can review the problem and provide a fix.

Thanks for letting us know about this.

[lubomir-mitev]

InfinitelyTest.txt
File is attached. Rename the file extension to java, because It's not possible to attach java file :( It's an unit test.

[Thisora]

I see that you set only setUnconfirmedPrivateTransfer to true.
I suppose that you are testing this kind of message.

I have an ArrayIndexOutOfBoundsException that is throw by ByteQueue when decoding:

java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 148
	at com.serotonin.bacnet4j.util.sero.ByteQueue.pop(ByteQueue.java:291)
	at com.serotonin.bacnet4j.type.EncodedValue.copyData(EncodedValue.java:98)
	at com.serotonin.bacnet4j.type.EncodedValue.readData(EncodedValue.java:85)
	at com.serotonin.bacnet4j.type.EncodedValue.readData(EncodedValue.java:79)
	at com.serotonin.bacnet4j.type.EncodedValue.<init>(EncodedValue.java:35)
	at com.serotonin.bacnet4j.type.Encodable.readEncodedValue(Encodable.java:500)
	at com.serotonin.bacnet4j.service.unconfirmed.UnconfirmedPrivateTransferRequest.<init>(UnconfirmedPrivateTransferRequest.java:68)
	at com.serotonin.bacnet4j.service.unconfirmed.UnconfirmedRequestService.createUnconfirmedRequestService(UnconfirmedRequestService.java:84)
	at com.serotonin.bacnet4j.apdu.UnconfirmedRequest.parseServiceData(UnconfirmedRequest.java:89)
	at com.serotonin.bacnet4j.transport.DefaultTransport.receiveAPDU(DefaultTransport.java:646)
	at com.serotonin.bacnet4j.transport.DefaultTransport.receiveImpl(DefaultTransport.java:578)
	at com.serotonin.bacnet4j.transport.DefaultTransport.run(DefaultTransport.java:498)
	at java.base/java.lang.Thread.run(Thread.java:1583)