[rc522][sml][kamstrup_kmp] Fix buffer bounds checks (#14515)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: J. Nick Koston <nick@koston.org>

esphome/components/kamstrup_kmp/kamstrup_kmp.cpp

@@ -136,7 +136,7 @@ void KamstrupKMPComponent::read_command_(uint16_t command) {
   int timeout = 250;  // ms
 
   // Read the data from the UART
-  while (timeout > 0) {
+  while (timeout > 0 && buffer_len < static_cast<int>(sizeof(buffer))) {
     if (this->available()) {
       data = this->read();
       if (data > -1) {
@@ -246,7 +246,7 @@ void KamstrupKMPComponent::parse_command_message_(uint16_t command, const uint8_
 }
 
 void KamstrupKMPComponent::set_sensor_value_(uint16_t command, float value, uint8_t unit_idx) {
-  const char *unit = UNITS[unit_idx];
+  const char *unit = unit_idx < sizeof(UNITS) / sizeof(UNITS[0]) ? UNITS[unit_idx] : "";
 
   // Standard sensors
   if (command == CMD_HEAT_ENERGY && this->heat_energy_sensor_ != nullptr) {

esphome/components/rc522/rc522.cpp

@@ -169,6 +169,7 @@ void RC522::loop() {
         default:
           ESP_LOGE(TAG, "uid_idx_ invalid, uid_idx_ = %d", uid_idx_);
           state_ = STATE_DONE;
+          return;
       }
       buffer_[1] = 32;
       pcd_transceive_data_(2);

esphome/components/sml/sml_parser.cpp

@@ -35,6 +35,8 @@ bool SmlFile::setup_node(SmlNode *node) {
 
   // Check if we need additional length bytes
   if (overlength) {
+    if (this->pos_ + 1 >= this->buffer_.size())
+      return false;
     // Shift the current length to the higher nibble
     // and add the lower nibble of the next byte to the length
     length = (length << 4) + (this->buffer_[this->pos_ + 1] & 0x0f);