From 6f0460b0ee3b34469888ac249b18c5a269648d51 Mon Sep 17 00:00:00 2001
From: Jonathan Swoboda <154711427+swoboda1337@users.noreply.github.com>
Date: Thu, 5 Mar 2026 14:46:47 -0500
Subject: [PATCH] [sim800l][tormatic][tx20] Fix OOB access, div-by-zero, and
 off-by-one (#14512)

Co-authored-by: J. Nick Koston <nick@koston.org>
---
 esphome/components/sim800l/sim800l.cpp         | 5 +++--
 esphome/components/tormatic/tormatic_cover.cpp | 3 +++
 esphome/components/tx20/tx20.cpp               | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/esphome/components/sim800l/sim800l.cpp b/esphome/components/sim800l/sim800l.cpp
index 2115c72cefa..913d920c94e 100644
--- a/esphome/components/sim800l/sim800l.cpp
+++ b/esphome/components/sim800l/sim800l.cpp
@@ -196,7 +196,8 @@ void Sim800LComponent::parse_cmd_(std::string message) {
     case STATE_CREG_WAIT: {
       // Response: "+CREG: 0,1" -- the one there means registered ok
       //           "+CREG: -,-" means not registered ok
-      bool registered = message.compare(0, 6, "+CREG:") == 0 && (message[9] == '1' || message[9] == '5');
+      bool registered =
+          message.size() > 9 && message.compare(0, 6, "+CREG:") == 0 && (message[9] == '1' || message[9] == '5');
       if (registered) {
         if (!this->registered_) {
           ESP_LOGD(TAG, "Registered OK");
@@ -205,7 +206,7 @@ void Sim800LComponent::parse_cmd_(std::string message) {
         this->expect_ack_ = true;
       } else {
         ESP_LOGW(TAG, "Registration Fail");
-        if (message[7] == '0') {  // Network registration is disable, enable it
+        if (message.size() > 7 && message[7] == '0') {  // Network registration is disabled, enable it
           send_cmd_("AT+CREG=1");
           this->expect_ack_ = true;
           this->state_ = STATE_SETUP_CMGF;
diff --git a/esphome/components/tormatic/tormatic_cover.cpp b/esphome/components/tormatic/tormatic_cover.cpp
index f567be0674f..37a269088e6 100644
--- a/esphome/components/tormatic/tormatic_cover.cpp
+++ b/esphome/components/tormatic/tormatic_cover.cpp
@@ -183,6 +183,9 @@ void Tormatic::recompute_position_() {
     duration = this->close_duration_;
   }
 
+  if (duration == 0)
+    return;
+
   auto delta = direction * diff / duration;
 
   this->position = clamp(this->position + delta, COVER_CLOSED, COVER_OPEN);
diff --git a/esphome/components/tx20/tx20.cpp b/esphome/components/tx20/tx20.cpp
index 6bc5f0bb514..3e0234fac04 100644
--- a/esphome/components/tx20/tx20.cpp
+++ b/esphome/components/tx20/tx20.cpp
@@ -191,7 +191,7 @@ void IRAM_ATTR Tx20ComponentStore::gpio_intr(Tx20ComponentStore *arg) {
     arg->tx20_available = true;
     return;
   }
-  if (index <= MAX_BUFFER_SIZE) {
+  if (index < MAX_BUFFER_SIZE) {
     arg->buffer[index] = delay;
   }
   arg->spent_time += delay;