From 60d48d6a580bd3344b5c459f9b41d37224e1c1f1 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Fri, 16 Jan 2026 13:57:32 -1000 Subject: [PATCH 1/3] [am43][lightwaverf][rf_bridge][spi_led_strip] Replace sprintf with safe alternatives --- esphome/components/am43/am43_base.cpp | 11 ++++------- esphome/components/lightwaverf/lightwaverf.cpp | 6 ++++-- esphome/components/rf_bridge/rf_bridge.cpp | 11 ++++++----- esphome/components/spi_led_strip/spi_led_strip.cpp | 7 ++++--- 4 files changed, 18 insertions(+), 17 deletions(-) diff --git a/esphome/components/am43/am43_base.cpp b/esphome/components/am43/am43_base.cpp index af474dcb79..3fe40a78b9 100644 --- a/esphome/components/am43/am43_base.cpp +++ b/esphome/components/am43/am43_base.cpp @@ -1,6 +1,6 @@ #include "am43_base.h" +#include "esphome/core/helpers.h" #include -#include namespace esphome { namespace am43 { @@ -8,12 +8,9 @@ namespace am43 { const uint8_t START_PACKET[5] = {0x00, 0xff, 0x00, 0x00, 0x9a}; std::string pkt_to_hex(const uint8_t *data, uint16_t len) { - char buf[64]; - memset(buf, 0, 64); - for (int i = 0; i < len; i++) - sprintf(&buf[i * 2], "%02x", data[i]); - std::string ret = buf; - return ret; + char buf[64]; // format_hex_size(31) = 63, fits 31 bytes of hex data + format_hex_to(buf, sizeof(buf), data, len); + return buf; } Am43Packet *Am43Encoder::get_battery_level_request() { diff --git a/esphome/components/lightwaverf/lightwaverf.cpp b/esphome/components/lightwaverf/lightwaverf.cpp index 31ac1fc576..6c427b7f95 100644 --- a/esphome/components/lightwaverf/lightwaverf.cpp +++ b/esphome/components/lightwaverf/lightwaverf.cpp @@ -1,3 +1,4 @@ +#include "esphome/core/helpers.h" #include "esphome/core/log.h" #ifdef USE_ESP8266 @@ -44,11 +45,12 @@ void LightWaveRF::send_rx(const std::vector &msg, uint8_t repeats, bool } void LightWaveRF::print_msg_(uint8_t *msg, uint8_t len) { - char buffer[65]; + char buffer[65]; // max 10 entries * 6 chars + null ESP_LOGD(TAG, " Received code (len:%i): ", len); + size_t pos = 0; for (int i = 0; i < len; i++) { - sprintf(&buffer[i * 6], "0x%02x, ", msg[i]); + pos = buf_append_printf(buffer, sizeof(buffer), pos, "0x%02x, ", msg[i]); } ESP_LOGD(TAG, "[%s]", buffer); } diff --git a/esphome/components/rf_bridge/rf_bridge.cpp b/esphome/components/rf_bridge/rf_bridge.cpp index 52ce037dbe..8105767485 100644 --- a/esphome/components/rf_bridge/rf_bridge.cpp +++ b/esphome/components/rf_bridge/rf_bridge.cpp @@ -1,6 +1,7 @@ #include "rf_bridge.h" -#include "esphome/core/log.h" #include "esphome/core/application.h" +#include "esphome/core/helpers.h" +#include "esphome/core/log.h" #include #include @@ -72,9 +73,9 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) { data.length = raw[2]; data.protocol = raw[3]; - char next_byte[3]; + char next_byte[3]; // 2 hex chars + null for (uint8_t i = 0; i < data.length - 1; i++) { - sprintf(next_byte, "%02X", raw[4 + i]); + buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[4 + i]); data.code += next_byte; } @@ -90,10 +91,10 @@ bool RFBridgeComponent::parse_bridge_byte_(uint8_t byte) { uint8_t buckets = raw[2] << 1; std::string str; - char next_byte[3]; + char next_byte[3]; // 2 hex chars + null for (uint32_t i = 0; i <= at; i++) { - sprintf(next_byte, "%02X", raw[i]); + buf_append_printf(next_byte, sizeof(next_byte), 0, "%02X", raw[i]); str += next_byte; if ((i > 3) && buckets) { buckets--; diff --git a/esphome/components/spi_led_strip/spi_led_strip.cpp b/esphome/components/spi_led_strip/spi_led_strip.cpp index afb51afe3a..1c09546c32 100644 --- a/esphome/components/spi_led_strip/spi_led_strip.cpp +++ b/esphome/components/spi_led_strip/spi_led_strip.cpp @@ -1,4 +1,5 @@ #include "spi_led_strip.h" +#include "esphome/core/helpers.h" namespace esphome { namespace spi_led_strip { @@ -48,11 +49,11 @@ void SpiLedStrip::write_state(light::LightState *state) { if (this->is_failed()) return; if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE) { - char strbuf[49]; + char strbuf[49]; // max 16 bytes * 3 chars each + null size_t len = std::min(this->buffer_size_, (size_t) (sizeof(strbuf) - 1) / 3); - memset(strbuf, 0, sizeof(strbuf)); + size_t pos = 0; for (size_t i = 0; i != len; i++) { - sprintf(strbuf + i * 3, "%02X ", this->buf_[i]); + pos = buf_append_printf(strbuf, sizeof(strbuf), pos, "%02X ", this->buf_[i]); } esph_log_v(TAG, "write_state: buf = %s", strbuf); } From 0d329f4f4d6b3a344632a423f21998c59b487e72 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Fri, 16 Jan 2026 14:00:30 -1000 Subject: [PATCH 2/3] [am43][lightwaverf][rf_bridge][spi_led_strip] Replace sprintf with safe alternatives --- esphome/components/spi_led_strip/spi_led_strip.cpp | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/esphome/components/spi_led_strip/spi_led_strip.cpp b/esphome/components/spi_led_strip/spi_led_strip.cpp index 1c09546c32..ff8d2e6ee0 100644 --- a/esphome/components/spi_led_strip/spi_led_strip.cpp +++ b/esphome/components/spi_led_strip/spi_led_strip.cpp @@ -48,15 +48,14 @@ void SpiLedStrip::dump_config() { void SpiLedStrip::write_state(light::LightState *state) { if (this->is_failed()) return; - if (ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE) { - char strbuf[49]; // max 16 bytes * 3 chars each + null - size_t len = std::min(this->buffer_size_, (size_t) (sizeof(strbuf) - 1) / 3); - size_t pos = 0; - for (size_t i = 0; i != len; i++) { - pos = buf_append_printf(strbuf, sizeof(strbuf), pos, "%02X ", this->buf_[i]); - } +#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE + { + char strbuf[49]; // format_hex_pretty_size(16) = 48, fits 16 bytes + size_t len = std::min(this->buffer_size_, (size_t) 16); + format_hex_pretty_to(strbuf, sizeof(strbuf), this->buf_, len, ' '); esph_log_v(TAG, "write_state: buf = %s", strbuf); } +#endif this->enable(); this->write_array(this->buf_, this->buffer_size_); this->disable(); From b7983b4774a7863949e5ea5f2e85d328142bcdd6 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Fri, 16 Jan 2026 14:01:48 -1000 Subject: [PATCH 3/3] [am43][lightwaverf][rf_bridge][spi_led_strip] Replace sprintf with safe alternatives --- esphome/components/lightwaverf/lightwaverf.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/esphome/components/lightwaverf/lightwaverf.cpp b/esphome/components/lightwaverf/lightwaverf.cpp index 6c427b7f95..2b44195c97 100644 --- a/esphome/components/lightwaverf/lightwaverf.cpp +++ b/esphome/components/lightwaverf/lightwaverf.cpp @@ -45,6 +45,7 @@ void LightWaveRF::send_rx(const std::vector &msg, uint8_t repeats, bool } void LightWaveRF::print_msg_(uint8_t *msg, uint8_t len) { +#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_DEBUG char buffer[65]; // max 10 entries * 6 chars + null ESP_LOGD(TAG, " Received code (len:%i): ", len); @@ -53,6 +54,7 @@ void LightWaveRF::print_msg_(uint8_t *msg, uint8_t len) { pos = buf_append_printf(buffer, sizeof(buffer), pos, "0x%02x, ", msg[i]); } ESP_LOGD(TAG, "[%s]", buffer); +#endif } void LightWaveRF::dump_config() {