From 4d26eeaf756391ca598eac58a880baae115e7924 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Fri, 16 Jan 2026 13:26:56 -1000 Subject: [PATCH] copilot found a bug, its not new though --- esphome/components/tx20/tx20.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/esphome/components/tx20/tx20.cpp b/esphome/components/tx20/tx20.cpp index aa2b653556..6516f936f3 100644 --- a/esphome/components/tx20/tx20.cpp +++ b/esphome/components/tx20/tx20.cpp @@ -48,8 +48,10 @@ void Tx20Component::decode_and_publish_() { std::array bit_buffer{}; size_t bit_pos = 0; bool current_bit = true; + // Cap at MAX_BUFFER_SIZE to prevent out-of-bounds access (buffer_index can exceed MAX_BUFFER_SIZE in ISR) + const int max_buffer_index = std::min(static_cast(this->store_.buffer_index), static_cast(MAX_BUFFER_SIZE)); - for (int i = 1; i <= this->store_.buffer_index; i++) { + for (int i = 1; i <= max_buffer_index; i++) { uint8_t repeat = this->store_.buffer[i] / TX20_BIT_TIME; // ignore segments at the end that were too short for (uint8_t j = 0; j < repeat && bit_pos < MAX_BUFFER_SIZE; j++) { @@ -109,7 +111,7 @@ void Tx20Component::decode_and_publish_() { // Build debug strings from completed data char debug_buf[320]; // buffer values: max 42 entries * 7 chars each size_t debug_pos = 0; - for (int i = 1; i <= this->store_.buffer_index; i++) { + for (int i = 1; i <= max_buffer_index; i++) { debug_pos = buf_append_printf(debug_buf, sizeof(debug_buf), debug_pos, "%u, ", this->store_.buffer[i]); } if (bits_before_padding < MAX_BUFFER_SIZE) {