From 22fc3aab392c8cad0c2d8a74e6074b83e7c17139 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Wed, 4 Mar 2026 13:19:46 -0500
Subject: [PATCH] [ld2420] Fix buffer overflows in simple mode, energy mode,
 and calibration (#14458)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
---
 esphome/components/ld2420/ld2420.cpp | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/esphome/components/ld2420/ld2420.cpp b/esphome/components/ld2420/ld2420.cpp
index f14400d15a..1e671363c9 100644
--- a/esphome/components/ld2420/ld2420.cpp
+++ b/esphome/components/ld2420/ld2420.cpp
@@ -460,6 +460,10 @@ void LD2420Component::handle_energy_mode_(uint8_t *buffer, int len) {
   uint8_t index = 6;  // Start at presence byte position
   uint16_t range;
   const uint8_t elements = sizeof(this->gate_energy_) / sizeof(this->gate_energy_[0]);
+  if (len < static_cast<int>(index + 1 + sizeof(range) + elements * sizeof(this->gate_energy_[0]))) {
+    ESP_LOGW(TAG, "Energy frame too short: %d bytes", len);
+    return;
+  }
   this->set_presence_(buffer[index]);
   index++;
   memcpy(&range, &buffer[index], sizeof(range));
@@ -471,8 +475,11 @@ void LD2420Component::handle_energy_mode_(uint8_t *buffer, int len) {
   }
 
   if (this->current_operating_mode == OP_CALIBRATE_MODE) {
-    this->update_radar_data(gate_energy_, sample_number_counter);
-    this->sample_number_counter > CALIBRATE_SAMPLES ? this->sample_number_counter = 0 : this->sample_number_counter++;
+    this->update_radar_data(gate_energy_, this->sample_number_counter);
+    this->sample_number_counter++;
+    if (this->sample_number_counter >= CALIBRATE_SAMPLES) {
+      this->sample_number_counter = 0;
+    }
   }
 
   // Resonable refresh rate for home assistant database size health
@@ -503,22 +510,20 @@ void LD2420Component::handle_simple_mode_(const uint8_t *inbuf, int len) {
   char *endptr{nullptr};
   char outbuf[bufsize]{0};
   while (true) {
-    if (inbuf[pos - 2] == 'O' && inbuf[pos - 1] == 'F' && inbuf[pos] == 'F') {
+    if (pos >= 2 && inbuf[pos - 2] == 'O' && inbuf[pos - 1] == 'F' && inbuf[pos] == 'F') {
       this->set_presence_(false);
-    } else if (inbuf[pos - 1] == 'O' && inbuf[pos] == 'N') {
+    } else if (pos >= 1 && inbuf[pos - 1] == 'O' && inbuf[pos] == 'N') {
       this->set_presence_(true);
     }
     if (inbuf[pos] >= '0' && inbuf[pos] <= '9') {
       if (index < bufsize - 1) {
         outbuf[index++] = inbuf[pos];
-        pos++;
       }
+    }
+    if (pos < len - 1) {
+      pos++;
     } else {
-      if (pos < len - 1) {
-        pos++;
-      } else {
-        break;
-      }
+      break;
     }
   }
   outbuf[index] = '\0';