github/esphome
2
0
Fork 0
mirror of https://github.com/esphome/esphome.git synced 2026-09-03 19:46:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

[shelly_dimmer][lvgl][seeed_mr60fda2][packet_transport] Fix buffer bounds checks (#14534)

Browse Source 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jonathan Swoboda
2026-03-06 10:47:56 -10:00
committed by GitHub
co-authored by Claude Opus 4.6
parent 4f4b2bfdec
commit 2c83c6a79f
4 changed files with 25 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
esphome/components/lvgl/lvgl_esphome.cpp
+3
View File
@@ -422,6 +422,9 @@ void LvglComponent::write_random_() {
auto row = random_uint32() % this->disp_drv_.ver_res;
row = row / this->draw_rounding * this->draw_rounding;
auto size = ((random_uint32() % 32) / this->draw_rounding + 2) * this->draw_rounding - 1;
// clamp size so the square fits within the draw buffer
if ((size + 1) * (size + 1) > this->draw_buf_.size)
size = static_cast<decltype(size)>(sqrtf(this->draw_buf_.size)) - 1;
lv_area_t area;
area.x1 = col;
area.y1 = row;
esphome/components/packet_transport/packet_transport.cpp
+2
View File
@@ -137,6 +137,8 @@ class PacketDecoder {
return DECODE_EMPTY;
if (this->buffer_[this->position_] != key)
return DECODE_UNMATCHED;
if (this->position_ + 1 + sizeof(T) > this->len_)
return DECODE_ERROR;
this->position_++;
T value = 0;
for (size_t i = 0; i != sizeof(T); ++i) {
esphome/components/seeed_mr60fda2/seeed_mr60fda2.cpp
+18 -26
View File
@@ -149,28 +149,25 @@ void MR60FDA2Component::split_frame_(uint8_t buffer) {
switch (this->current_frame_locate_) {
case LOCATE_FRAME_HEADER: // starting buffer
if (buffer == FRAME_HEADER_BUFFER) {
this->current_frame_len_ = 1;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_frame_len_ = 0;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
}
break;
case LOCATE_ID_FRAME1:
this->current_frame_id_ = buffer << 8;
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
break;
case LOCATE_ID_FRAME2:
this->current_frame_id_ += buffer;
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
break;
case LOCATE_LENGTH_FRAME_H:
this->current_data_frame_len_ = buffer << 8;
if (this->current_data_frame_len_ == 0x00) {
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
if (this->current_data_frame_len_ == 0) {
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
} else {
this->current_frame_locate_ = LOCATE_FRAME_HEADER;
@@ -181,15 +178,13 @@ void MR60FDA2Component::split_frame_(uint8_t buffer) {
if (this->current_data_frame_len_ > DATA_BUF_MAX_SIZE) {
this->current_frame_locate_ = LOCATE_FRAME_HEADER;
} else {
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
}
break;
case LOCATE_TYPE_FRAME1:
this->current_frame_type_ = buffer << 8;
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
break;
case LOCATE_TYPE_FRAME2:
@@ -198,8 +193,7 @@ void MR60FDA2Component::split_frame_(uint8_t buffer) {
(this->current_frame_type_ == PEOPLE_EXIST_TYPE_BUFFER) ||
(this->current_frame_type_ == RESULT_INSTALL_HEIGHT) || (this->current_frame_type_ == RESULT_PARAMETERS) ||
(this->current_frame_type_ == RESULT_HEIGHT_THRESHOLD) || (this->current_frame_type_ == RESULT_SENSITIVITY)) {
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
} else {
this->current_frame_locate_ = LOCATE_FRAME_HEADER;
@@ -207,8 +201,7 @@ void MR60FDA2Component::split_frame_(uint8_t buffer) {
break;
case LOCATE_HEAD_CKSUM_FRAME:
if (validate_checksum(this->current_frame_buf_, this->current_frame_len_, buffer)) {
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
} else {
ESP_LOGD(TAG, "HEAD_CKSUM_FRAME ERROR: 0x%02x", buffer);
@@ -223,21 +216,20 @@ void MR60FDA2Component::split_frame_(uint8_t buffer) {
}
break;
case LOCATE_DATA_FRAME:
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_data_buf_[this->current_frame_len_ - LEN_TO_DATA_FRAME] = buffer;
if (this->current_frame_len_ - LEN_TO_HEAD_CKSUM == this->current_data_frame_len_) {
this->current_frame_locate_++;
}
if (this->current_frame_len_ > FRAME_BUF_MAX_SIZE) {
if (this->current_frame_len_ >= FRAME_BUF_MAX_SIZE) {
ESP_LOGD(TAG, "PRACTICE_DATA_FRAME_LEN ERROR: %d", this->current_frame_len_ - LEN_TO_HEAD_CKSUM);
this->current_frame_locate_ = LOCATE_FRAME_HEADER;
break;
}
this->current_data_buf_[this->current_frame_len_ - LEN_TO_DATA_FRAME + 1] = buffer;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
if (this->current_frame_len_ - LEN_TO_HEAD_CKSUM == this->current_data_frame_len_) {
this->current_frame_locate_++;
}
break;
case LOCATE_DATA_CKSUM_FRAME:
if (validate_checksum(this->current_data_buf_, this->current_data_frame_len_, buffer)) {
this->current_frame_len_++;
this->current_frame_buf_[this->current_frame_len_ - 1] = buffer;
this->current_frame_buf_[this->current_frame_len_++] = buffer;
this->current_frame_locate_++;
this->process_frame_();
} else {
esphome/components/shelly_dimmer/shelly_dimmer.cpp
+2 -2
View File
@@ -188,8 +188,8 @@ bool ShellyDimmer::upgrade_firmware_() {
break;
}
std::memcpy(buffer, p, BUFFER_SIZE);
p += BUFFER_SIZE;
std::memcpy(buffer, p, len);
p += len;
if (stm32_write_memory(stm32, addr, buffer, len) != STM32_ERR_OK) {
ESP_LOGW(TAG, "Failed to write to STM32 flash memory");