From 17476934c858153fa0b05c58bf19a2d9d56a02eb Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Tue, 17 Mar 2026 18:34:24 -1000 Subject: [PATCH] [http_request] Guard against empty firmware_url before path merge Accessing path[0] on an empty string is undefined behavior. Add an empty check before the relative URL merge logic. --- esphome/components/http_request/update/http_request_update.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/esphome/components/http_request/update/http_request_update.cpp b/esphome/components/http_request/update/http_request_update.cpp index 4c0ae916c2..422b6367a4 100644 --- a/esphome/components/http_request/update/http_request_update.cpp +++ b/esphome/components/http_request/update/http_request_update.cpp @@ -170,7 +170,7 @@ void HttpRequestUpdate::update_task(void *params) { } // Merge source_url_ and firmware_url - if (info->firmware_url.find("http") == std::string::npos) { + if (!info->firmware_url.empty() && info->firmware_url.find("http") == std::string::npos) { std::string path = info->firmware_url; if (path[0] == '/') { std::string domain = this_update->source_url_.substr(0, this_update->source_url_.find('/', 8));