From 60d48d6a580bd3344b5c459f9b41d37224e1c1f1 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Fri, 16 Jan 2026 13:57:32 -1000
Subject: [PATCH] [am43][lightwaverf][rf_bridge][spi_led_strip] Replace sprintf
 with safe alternatives

---
 esphome/components/am43/am43_base.cpp              | 11 ++++-------
 esphome/components/lightwaverf/lightwaverf.cpp     |  6 ++++--
 esphome/components/rf_bridge/rf_bridge.cpp         | 11 ++++++-----
 esphome/components/spi_led_strip/spi_led_strip.cpp |  7 ++++---
 4 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/esphome/components/am43/am43_base.cpp b/esphome/components/am43/am43_base.cpp
index af474dcb799..3fe40a78b9e 100644
--- a/esphome/components/am43/am43_base.cpp
+++ b/esphome/components/am43/am43_base.cpp
@@ -1,6 +1,6 @@
 #include "am43_base.h"
+#include "esphome/core/helpers.h"
 #include <cstring>
-#include <cstdio>
 
 namespace esphome {
 namespace am43 {
@@ -8,12 +8,9 @@ namespace am43 {
 const uint8_t START_PACKET[5] = {0x00, 0xff, 0x00, 0x00, 0x9a};
 
 std::string pkt_to_hex(const uint8_t *data, uint16_t len) {
-  char buf[64];
-  memset(buf, 0, 64);
-  for (int i = 0; i < len; i++)
-    sprintf(&buf[i * 2], "%02x", data[i]);
-  std::string ret = buf;
-  return ret;
+  char buf[64];  // format_hex_size(31) = 63, fits 31 bytes of hex data
+  format_hex_to(buf, sizeof(buf), data, len);
+  return buf;
 }
 
 Am43Packet *Am43Encoder::get_battery_level_request() {
diff --git a/esphome/components/lightwaverf/lightwaverf.cpp b/esphome/components/lightwaverf/lightwaverf.cpp
index 31ac1fc576d..6c427b7f95a 100644
--- a/esphome/components/lightwaverf/lightwaverf.cpp
+++ b/esphome/components/lightwaverf/lightwaverf.cpp
@@ -1,3 +1,4 @@
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 #ifdef USE_ESP8266
@@ -44,11 +45,12 @@ void LightWaveRF::send_rx(const std::vector<uint8_t> &msg, uint8_t repeats, bool
 }
 
 void LightWaveRF::print_msg_(uint8_t *msg, uint8_t len) {
-  char buffer[65];
+  char buffer[65];  // max 10 entries * 6 chars + null
   ESP_LOGD(TAG, " Received code (len:%i): ", len);
 
+  size_t pos = 0;
   for (int i = 0; i < len; i++) {
-    sprintf(&buffer[i * 6], "0x%02x, ", msg[i]);
+    pos = buf_append_printf(buffer, sizeof(buffer), pos, "0x%02x, ", msg[i]);
   }
   ESP_LOGD(TAG, "[%s]", buffer);
 }
diff --git a/esphome/components/rf_bridge/rf_bridge.cpp b/esphome/components/rf_bridge/rf_bridge.cpp
index 52ce037dbed..8105767485a 100644
--- a/esphome/components/rf_bridge/rf_bridge.cpp
+++ b/esphome/components/rf_bridge/rf_bridge.cpp
@@ -1,6 +1,7 @@
 #include "rf_bridge.h"
-#include "esphome/core/log.h"
 #include "esphome/core/application.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
 #include <cinttypes>
 #include <cstring>
 
@@ -72,9 +73,9 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
 
       data.length = raw[2];
       data.protocol = raw[3];
-      char next_byte[3];
+      char next_byte[3];  // 2 hex chars + null
       for (uint8_t i = 0; i < data.length - 1; i++) {
-        sprintf(next_byte, "%02X", raw[4 + i]);
+        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[4 + i]);
         data.code += next_byte;
       }
 
@@ -90,10 +91,10 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) {
 
       uint8_t buckets = raw[2] << 1;
       std::string str;
-      char next_byte[3];
+      char next_byte[3];  // 2 hex chars + null
 
       for (uint32_t i = 0; i <= at; i++) {
-        sprintf(next_byte, "%02X", raw[i]);
+        buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[i]);
         str += next_byte;
         if ((i > 3) && buckets) {
           buckets--;
diff --git a/esphome/components/spi_led_strip/spi_led_strip.cpp b/esphome/components/spi_led_strip/spi_led_strip.cpp
index afb51afe3a3..1c09546c325 100644
--- a/esphome/components/spi_led_strip/spi_led_strip.cpp
+++ b/esphome/components/spi_led_strip/spi_led_strip.cpp
@@ -1,4 +1,5 @@
 #include "spi_led_strip.h"
+#include "esphome/core/helpers.h"
 
 namespace esphome {
 namespace spi_led_strip {
@@ -48,11 +49,11 @@ void SpiLedStrip::write_state(light::LightState *state) {
   if (this->is_failed())
     return;
   if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE) {
-    char strbuf[49];
+    char strbuf[49];  // max 16 bytes * 3 chars each + null
     size_t len = std::min(this->buffer_size_, (size_t) (sizeof(strbuf) - 1) / 3);
-    memset(strbuf, 0, sizeof(strbuf));
+    size_t pos = 0;
     for (size_t i = 0; i != len; i++) {
-      sprintf(strbuf + i * 3, "%02X ", this->buf_[i]);
+      pos = buf_append_printf(strbuf, sizeof(strbuf), pos, "%02X ", this->buf_[i]);
     }
     esph_log_v(TAG, "write_state: buf = %s", strbuf);
   }