[inkplate][ezo_pmp][ezo][packet_transport] Fix use-after-free bugs (#14467)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

esphome/components/ezo/ezo.cpp

@@ -66,8 +66,9 @@ void EZOSensor::loop() {
 
     if (to_run->command_type == EzoCommandType::EZO_SLEEP ||
         to_run->command_type == EzoCommandType::EZO_I2C) {  // Commands with no return data
+      bool update_address = to_run->command_type == EzoCommandType::EZO_I2C;
       this->commands_.pop_front();
-      if (to_run->command_type == EzoCommandType::EZO_I2C)
+      if (update_address)
         this->address_ = this->new_address_;
       return;
     }

esphome/components/ezo_pmp/ezo_pmp.cpp

@@ -165,22 +165,23 @@ void EzoPMP::read_command_result_() {
       continue;
     }
 
-    switch (current_parameter) {
-      case 1:
-        first_parameter_buffer[position_in_parameter_buffer] = current_char;
-        first_parameter_buffer[position_in_parameter_buffer + 1] = '\0';
-        break;
-      case 2:
-        second_parameter_buffer[position_in_parameter_buffer] = current_char;
-        second_parameter_buffer[position_in_parameter_buffer + 1] = '\0';
-        break;
-      case 3:
-        third_parameter_buffer[position_in_parameter_buffer] = current_char;
-        third_parameter_buffer[position_in_parameter_buffer + 1] = '\0';
-        break;
+    if (position_in_parameter_buffer < sizeof(first_parameter_buffer) - 1) {
+      switch (current_parameter) {
+        case 1:
+          first_parameter_buffer[position_in_parameter_buffer] = current_char;
+          first_parameter_buffer[position_in_parameter_buffer + 1] = '\0';
+          break;
+        case 2:
+          second_parameter_buffer[position_in_parameter_buffer] = current_char;
+          second_parameter_buffer[position_in_parameter_buffer + 1] = '\0';
+          break;
+        case 3:
+          third_parameter_buffer[position_in_parameter_buffer] = current_char;
+          third_parameter_buffer[position_in_parameter_buffer + 1] = '\0';
+          break;
+      }
+      position_in_parameter_buffer++;
     }
-
-    position_in_parameter_buffer++;
   }
 
   auto parsed_first_parameter = parse_number<float>(first_parameter_buffer);
@@ -404,7 +405,8 @@ void EzoPMP::send_next_command_() {
       break;
 
     case EZO_PMP_COMMAND_EXEC_ARBITRARY_COMMAND_ADDRESS:  // Run an arbitrary command
-      command_buffer_length = snprintf((char *) command_buffer, sizeof(command_buffer), "%s", this->arbitrary_command_);
+      command_buffer_length =
+          snprintf((char *) command_buffer, sizeof(command_buffer), "%s", this->arbitrary_command_.c_str());
       ESP_LOGI(TAG, "Sending arbitrary command: %s", (char *) command_buffer);
       break;
 
@@ -541,7 +543,7 @@ void EzoPMP::change_i2c_address(int address) {
 }
 
 void EzoPMP::exec_arbitrary_command(const std::basic_string<char> &command) {
-  this->arbitrary_command_ = command.c_str();
+  this->arbitrary_command_ = command;
   this->queue_command_(EZO_PMP_COMMAND_EXEC_ARBITRARY_COMMAND_ADDRESS, 0, 0, true);
 }
 

esphome/components/ezo_pmp/ezo_pmp.h

@@ -85,7 +85,7 @@ class EzoPMP : public PollingComponent, public i2c::I2CDevice {
   bool is_paused_flag_ = false;
   bool is_dosing_flag_ = false;
 
-  const char *arbitrary_command_{nullptr};
+  std::string arbitrary_command_{};
 
   void send_next_command_();
   void read_command_result_();

esphome/components/inkplate/inkplate.cpp

@@ -63,16 +63,26 @@ void Inkplate::initialize_() {
   if (buffer_size == 0)
     return;
 
-  if (this->partial_buffer_ != nullptr)
+  if (this->partial_buffer_ != nullptr) {
     allocator.deallocate(this->partial_buffer_, buffer_size);
-  if (this->partial_buffer_2_ != nullptr)
+    this->partial_buffer_ = nullptr;
+  }
+  if (this->partial_buffer_2_ != nullptr) {
     allocator.deallocate(this->partial_buffer_2_, buffer_size * 2);
-  if (this->buffer_ != nullptr)
+    this->partial_buffer_2_ = nullptr;
+  }
+  if (this->buffer_ != nullptr) {
     allocator.deallocate(this->buffer_, buffer_size);
-  if (this->glut_ != nullptr)
+    this->buffer_ = nullptr;
+  }
+  if (this->glut_ != nullptr) {
     allocator32.deallocate(this->glut_, 256 * 9);
-  if (this->glut2_ != nullptr)
+    this->glut_ = nullptr;
+  }
+  if (this->glut2_ != nullptr) {
     allocator32.deallocate(this->glut2_, 256 * 9);
+    this->glut2_ = nullptr;
+  }
 
   this->buffer_ = allocator.allocate(buffer_size);
   if (this->buffer_ == nullptr) {

esphome/components/packet_transport/packet_transport.cpp

@@ -249,7 +249,7 @@ void PacketTransport::init_data_() {
   } else {
     add(this->data_, DATA_KEY);
   }
-  for (auto pkey : this->ping_keys_) {
+  for (const auto &pkey : this->ping_keys_) {
     add(this->data_, PING_KEY);
     add(this->data_, pkey.second);
   }

esphome/components/packet_transport/packet_transport.h

@@ -150,7 +150,7 @@ class PacketTransport : public PollingComponent {
   std::vector<uint8_t> ping_header_{};
   std::vector<uint8_t> header_{};
   std::vector<uint8_t> data_{};
-  std::map<const char *, uint32_t> ping_keys_{};
+  std::map<std::string, uint32_t> ping_keys_{};
   const char *platform_name_{""};
   void add_key_(const char *name, uint32_t key);
   void send_ping_pong_request_();