From 472b5de30e01951848bb5fd445e8227a420ac5c8 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Tue, 8 Sep 2026 18:00:28 +0200 Subject: [PATCH] Zero the inflate window so a corrupt back reference copies zeros, not stale memory --- esphome/components/esphome/ota/ota_esphome.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/esphome/components/esphome/ota/ota_esphome.cpp b/esphome/components/esphome/ota/ota_esphome.cpp index 6a11786086..9f55f67524 100644 --- a/esphome/components/esphome/ota/ota_esphome.cpp +++ b/esphome/components/esphome/ota/ota_esphome.cpp @@ -24,6 +24,7 @@ #include #include +#include #include #include @@ -857,6 +858,9 @@ ota::OTAResponseTypes ESPHomeOTAComponent::inflate_data_(uint8_t *in, size_t ima session.image_size = image_size; session.written = 0; session.error = ota::OTA_RESPONSE_OK; + // A corrupt stream may back reference the window before it is filled; zero it + // so such a read copies zeros, never stale memory + std::memset(session.window, 0, sizeof(session.window)); ota_inflate_init(&session, session.window, OTA_INFLATE_WINDOW_SIZE); // Where the ack must follow the write, flush and ack before waiting for // input, or the client waits for an ack while the decoder waits for data