From 52ac9e18616a1a8688745badcf09520c0370ef7c Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Fri, 16 Jan 2026 12:56:47 -1000 Subject: [PATCH 1/2] [remote_base] Replace unsafe sprintf with buf_append_printf; fix buffer overflow (#13257) Co-authored-by: Keith Burzinski Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .../components/remote_base/aeha_protocol.cpp | 4 +-- .../components/remote_base/raw_protocol.cpp | 27 ++++++++---------- .../components/remote_base/remote_base.cpp | 28 ++++++++----------- 3 files changed, 25 insertions(+), 34 deletions(-) diff --git a/esphome/components/remote_base/aeha_protocol.cpp b/esphome/components/remote_base/aeha_protocol.cpp index 04fe731817..3b926e7981 100644 --- a/esphome/components/remote_base/aeha_protocol.cpp +++ b/esphome/components/remote_base/aeha_protocol.cpp @@ -85,8 +85,8 @@ optional AEHAProtocol::decode(RemoteReceiveData src) { std::string AEHAProtocol::format_data_(const std::vector &data) { std::string out; for (uint8_t byte : data) { - char buf[6]; - sprintf(buf, "0x%02X,", byte); + char buf[8]; // "0x%02X," = 5 chars + null + margin + snprintf(buf, sizeof(buf), "0x%02X,", byte); out += buf; } out.pop_back(); diff --git a/esphome/components/remote_base/raw_protocol.cpp b/esphome/components/remote_base/raw_protocol.cpp index ef0cb8454e..7e6be3b77e 100644 --- a/esphome/components/remote_base/raw_protocol.cpp +++ b/esphome/components/remote_base/raw_protocol.cpp @@ -1,4 +1,5 @@ #include "raw_protocol.h" +#include "esphome/core/helpers.h" #include "esphome/core/log.h" namespace esphome { @@ -8,36 +9,30 @@ static const char *const TAG = "remote.raw"; bool RawDumper::dump(RemoteReceiveData src) { char buffer[256]; - uint32_t buffer_offset = 0; - buffer_offset += sprintf(buffer, "Received Raw: "); + size_t pos = buf_append_printf(buffer, sizeof(buffer), 0, "Received Raw: "); for (int32_t i = 0; i < src.size() - 1; i++) { const int32_t value = src[i]; - const uint32_t remaining_length = sizeof(buffer) - buffer_offset; - int written; + size_t prev_pos = pos; if (i + 1 < src.size() - 1) { - written = snprintf(buffer + buffer_offset, remaining_length, "%" PRId32 ", ", value); + pos = buf_append_printf(buffer, sizeof(buffer), pos, "%" PRId32 ", ", value); } else { - written = snprintf(buffer + buffer_offset, remaining_length, "%" PRId32, value); + pos = buf_append_printf(buffer, sizeof(buffer), pos, "%" PRId32, value); } - if (written < 0 || written >= int(remaining_length)) { - // write failed, flush... - buffer[buffer_offset] = '\0'; + if (pos >= sizeof(buffer) - 1) { + // buffer full, flush and continue + buffer[prev_pos] = '\0'; ESP_LOGI(TAG, "%s", buffer); - buffer_offset = 0; - written = sprintf(buffer, " "); if (i + 1 < src.size() - 1) { - written += sprintf(buffer + written, "%" PRId32 ", ", value); + pos = buf_append_printf(buffer, sizeof(buffer), 0, " %" PRId32 ", ", value); } else { - written += sprintf(buffer + written, "%" PRId32, value); + pos = buf_append_printf(buffer, sizeof(buffer), 0, " %" PRId32, value); } } - - buffer_offset += written; } - if (buffer_offset != 0) { + if (pos != 0) { ESP_LOGI(TAG, "%s", buffer); } return true; diff --git a/esphome/components/remote_base/remote_base.cpp b/esphome/components/remote_base/remote_base.cpp index e3d9463243..53c9c38c7d 100644 --- a/esphome/components/remote_base/remote_base.cpp +++ b/esphome/components/remote_base/remote_base.cpp @@ -1,4 +1,5 @@ #include "remote_base.h" +#include "esphome/core/helpers.h" #include "esphome/core/log.h" #include @@ -169,36 +170,31 @@ void RemoteTransmitterBase::send_(uint32_t send_times, uint32_t send_wait) { #ifdef ESPHOME_LOG_HAS_VERY_VERBOSE const auto &vec = this->temp_.get_data(); char buffer[256]; - uint32_t buffer_offset = 0; - buffer_offset += sprintf(buffer, "Sending times=%" PRIu32 " wait=%" PRIu32 "ms: ", send_times, send_wait); + size_t pos = buf_append_printf(buffer, sizeof(buffer), 0, + "Sending times=%" PRIu32 " wait=%" PRIu32 "ms: ", send_times, send_wait); for (size_t i = 0; i < vec.size(); i++) { const int32_t value = vec[i]; - const uint32_t remaining_length = sizeof(buffer) - buffer_offset; - int written; + size_t prev_pos = pos; if (i + 1 < vec.size()) { - written = snprintf(buffer + buffer_offset, remaining_length, "%" PRId32 ", ", value); + pos = buf_append_printf(buffer, sizeof(buffer), pos, "%" PRId32 ", ", value); } else { - written = snprintf(buffer + buffer_offset, remaining_length, "%" PRId32, value); + pos = buf_append_printf(buffer, sizeof(buffer), pos, "%" PRId32, value); } - if (written < 0 || written >= int(remaining_length)) { - // write failed, flush... - buffer[buffer_offset] = '\0'; + if (pos >= sizeof(buffer) - 1) { + // buffer full, flush and continue + buffer[prev_pos] = '\0'; ESP_LOGVV(TAG, "%s", buffer); - buffer_offset = 0; - written = sprintf(buffer, " "); if (i + 1 < vec.size()) { - written += sprintf(buffer + written, "%" PRId32 ", ", value); + pos = buf_append_printf(buffer, sizeof(buffer), 0, " %" PRId32 ", ", value); } else { - written += sprintf(buffer + written, "%" PRId32, value); + pos = buf_append_printf(buffer, sizeof(buffer), 0, " %" PRId32, value); } } - - buffer_offset += written; } - if (buffer_offset != 0) { + if (pos != 0) { ESP_LOGVV(TAG, "%s", buffer); } #endif From 9c0eccd81b758e59cd42f312cea9aad6e3e595ec Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Fri, 16 Jan 2026 13:15:31 -1000 Subject: [PATCH 2/2] [tx20] Eliminate heap allocations in wind sensor --- esphome/components/tx20/tx20.cpp | 42 +++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 14 deletions(-) diff --git a/esphome/components/tx20/tx20.cpp b/esphome/components/tx20/tx20.cpp index fd7b5fb03f..06895f0187 100644 --- a/esphome/components/tx20/tx20.cpp +++ b/esphome/components/tx20/tx20.cpp @@ -2,7 +2,7 @@ #include "esphome/core/helpers.h" #include "esphome/core/log.h" -#include +#include namespace esphome { namespace tx20 { @@ -45,25 +45,22 @@ std::string Tx20Component::get_wind_cardinal_direction() const { return this->wi void Tx20Component::decode_and_publish_() { ESP_LOGVV(TAG, "Decode Tx20"); - std::string string_buffer; - std::string string_buffer_2; - std::vector bit_buffer; + std::array bit_buffer{}; + size_t bit_pos = 0; bool current_bit = true; for (int i = 1; i <= this->store_.buffer_index; i++) { - string_buffer_2 += to_string(this->store_.buffer[i]) + ", "; uint8_t repeat = this->store_.buffer[i] / TX20_BIT_TIME; // ignore segments at the end that were too short - string_buffer.append(repeat, current_bit ? '1' : '0'); - bit_buffer.insert(bit_buffer.end(), repeat, current_bit); + for (uint8_t j = 0; j < repeat && bit_pos < MAX_BUFFER_SIZE; j++) { + bit_buffer[bit_pos++] = current_bit; + } current_bit = !current_bit; } current_bit = !current_bit; - if (string_buffer.length() < MAX_BUFFER_SIZE) { - uint8_t remain = MAX_BUFFER_SIZE - string_buffer.length(); - string_buffer_2 += to_string(remain) + ", "; - string_buffer.append(remain, current_bit ? '1' : '0'); - bit_buffer.insert(bit_buffer.end(), remain, current_bit); + size_t bits_before_padding = bit_pos; + while (bit_pos < MAX_BUFFER_SIZE) { + bit_buffer[bit_pos++] = current_bit; } uint8_t tx20_sa = 0; @@ -108,8 +105,25 @@ void Tx20Component::decode_and_publish_() { // 2. Check received checksum matches calculated checksum // 3. Check that Wind Direction matches Wind Direction (Inverted) // 4. Check that Wind Speed matches Wind Speed (Inverted) - ESP_LOGVV(TAG, "BUFFER %s", string_buffer_2.c_str()); - ESP_LOGVV(TAG, "Decoded bits %s", string_buffer.c_str()); +#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERY_VERBOSE + // Build debug strings from completed data + char debug_buf[320]; // buffer values: max 42 entries * 7 chars each + size_t debug_pos = 0; + for (int i = 1; i <= this->store_.buffer_index; i++) { + debug_pos = buf_append_printf(debug_buf, sizeof(debug_buf), debug_pos, "%u, ", this->store_.buffer[i]); + } + if (bits_before_padding < MAX_BUFFER_SIZE) { + debug_pos = + buf_append_printf(debug_buf, sizeof(debug_buf), debug_pos, "%zu, ", MAX_BUFFER_SIZE - bits_before_padding); + } + char bits_buf[MAX_BUFFER_SIZE + 1]; + for (size_t i = 0; i < MAX_BUFFER_SIZE; i++) { + bits_buf[i] = bit_buffer[i] ? '1' : '0'; + } + bits_buf[MAX_BUFFER_SIZE] = '\0'; + ESP_LOGVV(TAG, "BUFFER %s", debug_buf); + ESP_LOGVV(TAG, "Decoded bits %s", bits_buf); +#endif if (tx20_sa == 4) { if (chk == tx20_sd) {