From 666fb7cf39aeaf2e2a7890695099535ed8b5a67c Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Fri, 6 Mar 2026 07:18:28 -0500
Subject: [PATCH] [sx127x][sx126x][max6956] Fix null deref, unterminated
 string, and pin bounds check (#14529)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
---
 esphome/components/max6956/max6956.cpp | 2 ++
 esphome/components/sx126x/sx126x.cpp   | 3 ++-
 esphome/components/sx127x/sx127x.cpp   | 5 +++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/esphome/components/max6956/max6956.cpp b/esphome/components/max6956/max6956.cpp
index a350e66ee0..ce45541b63 100644
--- a/esphome/components/max6956/max6956.cpp
+++ b/esphome/components/max6956/max6956.cpp
@@ -111,6 +111,8 @@ void MAX6956::write_brightness_mode() {
 }
 
 void MAX6956::set_pin_brightness(uint8_t pin, float brightness) {
+  if (pin < MAX6956_MIN || pin > MAX6956_MAX)
+    return;
   uint8_t reg_addr = MAX6956_CURRENT_START + (pin - MAX6956_MIN) / 2;
   uint8_t config = 0;
   uint8_t shift = 4 * (pin % 2);
diff --git a/esphome/components/sx126x/sx126x.cpp b/esphome/components/sx126x/sx126x.cpp
index 64cd24b171..ec62fad10a 100644
--- a/esphome/components/sx126x/sx126x.cpp
+++ b/esphome/components/sx126x/sx126x.cpp
@@ -155,7 +155,8 @@ void SX126x::configure() {
   }
 
   // check silicon version to make sure hw is ok
-  this->read_register_(REG_VERSION_STRING, (uint8_t *) this->version_, 16);
+  this->read_register_(REG_VERSION_STRING, (uint8_t *) this->version_, sizeof(this->version_));
+  this->version_[sizeof(this->version_) - 1] = '\0';
   if (strncmp(this->version_, "SX126", 5) != 0 && strncmp(this->version_, "LLCC68", 6) != 0) {
     this->mark_failed();
     return;
diff --git a/esphome/components/sx127x/sx127x.cpp b/esphome/components/sx127x/sx127x.cpp
index f6aa11b634..66957a7342 100644
--- a/esphome/components/sx127x/sx127x.cpp
+++ b/esphome/components/sx127x/sx127x.cpp
@@ -260,6 +260,11 @@ SX127xError SX127x::transmit_packet(const std::vector<uint8_t> &packet) {
     return SX127xError::INVALID_PARAMS;
   }
 
+  if (this->dio0_pin_ == nullptr) {
+    ESP_LOGE(TAG, "DIO0 pin not configured, cannot wait for transmit completion");
+    return SX127xError::INVALID_PARAMS;
+  }
+
   SX127xError ret = SX127xError::NONE;
   if (this->modulation_ == MOD_LORA) {
     this->set_mode_standby();