BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacappdecodeapplication_data in bacapp.c.