[nextion] Replace to_string with stack buffer and fix unsafe sprintf

esphome/components/nextion/nextion.cpp

@@ -1,6 +1,7 @@
 #include "nextion.h"
 #include <cinttypes>
 #include "esphome/core/application.h"
+#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "esphome/core/util.h"
 
@@ -1283,8 +1284,9 @@ void Nextion::check_pending_waveform_() {
   size_t buffer_to_send = component->get_wave_buffer_size() < 255 ? component->get_wave_buffer_size()
                                                                   : 255;  // ADDT command can only send 255
 
-  std::string command = "addt " + to_string(component->get_component_id()) + "," +
-                        to_string(component->get_wave_channel_id()) + "," + to_string(buffer_to_send);
+  char command[24];  // "addt " + uint8 + "," + uint8 + "," + uint8 + null = max 17 chars
+  buf_append_printf(command, sizeof(command), 0, "addt %u,%u,%zu", component->get_component_id(),
+                    component->get_wave_channel_id(), buffer_to_send);
   if (!this->send_command_(command)) {
     delete nb;  // NOLINT(cppcoreguidelines-owning-memory)
     this->waveform_queue_.pop_front();

esphome/components/nextion/nextion_upload_arduino.cpp

@@ -34,7 +34,7 @@ int Nextion::upload_by_chunks_(HTTPClient &http_client, uint32_t &range_start) {
   }
 
   char range_header[32];
-  sprintf(range_header, "bytes=%" PRIu32 "-%" PRIu32, range_start, range_end);
+  buf_append_printf(range_header, sizeof(range_header), 0, "bytes=%" PRIu32 "-%" PRIu32, range_start, range_end);
   ESP_LOGV(TAG, "Range: %s", range_header);
   http_client.addHeader("Range", range_header);
   int code = http_client.GET();

esphome/components/nextion/nextion_upload_esp32.cpp

@@ -36,7 +36,7 @@ int Nextion::upload_by_chunks_(esp_http_client_handle_t http_client, uint32_t &r
   }
 
   char range_header[32];
-  sprintf(range_header, "bytes=%" PRIu32 "-%" PRIu32, range_start, range_end);
+  buf_append_printf(range_header, sizeof(range_header), 0, "bytes=%" PRIu32 "-%" PRIu32, range_start, range_end);
   ESP_LOGV(TAG, "Range: %s", range_header);
   esp_http_client_set_header(http_client, "Range", range_header);
   ESP_LOGV(TAG, "Open HTTP");

esphome/components/remote_base/aeha_protocol.cpp

@@ -85,8 +85,8 @@ optional<AEHAData> AEHAProtocol::decode(RemoteReceiveData src) {
 std::string AEHAProtocol::format_data_(const std::vector<uint8_t> &data) {
   std::string out;
   for (uint8_t byte : data) {
-    char buf[8];  // "0x%02X," = 5 chars + null + margin
-    snprintf(buf, sizeof(buf), "0x%02X,", byte);
+    char buf[6];
+    sprintf(buf, "0x%02X,", byte);
     out += buf;
   }
   out.pop_back();

esphome/components/remote_base/raw_protocol.cpp

@@ -1,5 +1,4 @@
 #include "raw_protocol.h"
-#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 namespace esphome {
@@ -9,30 +8,36 @@ static const char *const TAG = "remote.raw";
 
 bool RawDumper::dump(RemoteReceiveData src) {
   char buffer[256];
-  size_t pos = buf_append_printf(buffer, sizeof(buffer), 0, "Received Raw: ");
+  uint32_t buffer_offset = 0;
+  buffer_offset += sprintf(buffer, "Received Raw: ");
 
   for (int32_t i = 0; i < src.size() - 1; i++) {
     const int32_t value = src[i];
-    size_t prev_pos = pos;
+    const uint32_t remaining_length = sizeof(buffer) - buffer_offset;
+    int written;
 
     if (i + 1 < src.size() - 1) {
-      pos = buf_append_printf(buffer, sizeof(buffer), pos, "%" PRId32 ", ", value);
+      written = snprintf(buffer + buffer_offset, remaining_length, "%" PRId32 ", ", value);
     } else {
-      pos = buf_append_printf(buffer, sizeof(buffer), pos, "%" PRId32, value);
+      written = snprintf(buffer + buffer_offset, remaining_length, "%" PRId32, value);
     }
 
-    if (pos >= sizeof(buffer) - 1) {
-      // buffer full, flush and continue
-      buffer[prev_pos] = '\0';
+    if (written < 0 || written >= int(remaining_length)) {
+      // write failed, flush...
+      buffer[buffer_offset] = '\0';
       ESP_LOGI(TAG, "%s", buffer);
+      buffer_offset = 0;
+      written = sprintf(buffer, "  ");
       if (i + 1 < src.size() - 1) {
-        pos = buf_append_printf(buffer, sizeof(buffer), 0, "  %" PRId32 ", ", value);
+        written += sprintf(buffer + written, "%" PRId32 ", ", value);
       } else {
-        pos = buf_append_printf(buffer, sizeof(buffer), 0, "  %" PRId32, value);
+        written += sprintf(buffer + written, "%" PRId32, value);
       }
     }
+
+    buffer_offset += written;
   }
-  if (pos != 0) {
+  if (buffer_offset != 0) {
     ESP_LOGI(TAG, "%s", buffer);
   }
   return true;

esphome/components/remote_base/remote_base.cpp

@@ -1,5 +1,4 @@
 #include "remote_base.h"
-#include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
 #include <cinttypes>
@@ -170,31 +169,36 @@ void RemoteTransmitterBase::send_(uint32_t send_times, uint32_t send_wait) {
 #ifdef ESPHOME_LOG_HAS_VERY_VERBOSE
   const auto &vec = this->temp_.get_data();
   char buffer[256];
-  size_t pos = buf_append_printf(buffer, sizeof(buffer), 0,
-                                 "Sending times=%" PRIu32 " wait=%" PRIu32 "ms: ", send_times, send_wait);
+  uint32_t buffer_offset = 0;
+  buffer_offset += sprintf(buffer, "Sending times=%" PRIu32 " wait=%" PRIu32 "ms: ", send_times, send_wait);
 
   for (size_t i = 0; i < vec.size(); i++) {
     const int32_t value = vec[i];
-    size_t prev_pos = pos;
+    const uint32_t remaining_length = sizeof(buffer) - buffer_offset;
+    int written;
 
     if (i + 1 < vec.size()) {
-      pos = buf_append_printf(buffer, sizeof(buffer), pos, "%" PRId32 ", ", value);
+      written = snprintf(buffer + buffer_offset, remaining_length, "%" PRId32 ", ", value);
     } else {
-      pos = buf_append_printf(buffer, sizeof(buffer), pos, "%" PRId32, value);
+      written = snprintf(buffer + buffer_offset, remaining_length, "%" PRId32, value);
     }
 
-    if (pos >= sizeof(buffer) - 1) {
-      // buffer full, flush and continue
-      buffer[prev_pos] = '\0';
+    if (written < 0 || written >= int(remaining_length)) {
+      // write failed, flush...
+      buffer[buffer_offset] = '\0';
       ESP_LOGVV(TAG, "%s", buffer);
+      buffer_offset = 0;
+      written = sprintf(buffer, "  ");
       if (i + 1 < vec.size()) {
-        pos = buf_append_printf(buffer, sizeof(buffer), 0, "  %" PRId32 ", ", value);
+        written += sprintf(buffer + written, "%" PRId32 ", ", value);
       } else {
-        pos = buf_append_printf(buffer, sizeof(buffer), 0, "  %" PRId32, value);
+        written += sprintf(buffer + written, "%" PRId32, value);
       }
     }
+
+    buffer_offset += written;
   }
-  if (pos != 0) {
+  if (buffer_offset != 0) {
     ESP_LOGVV(TAG, "%s", buffer);
   }
 #endif

script/ci-custom.py

@@ -728,26 +728,6 @@ def lint_no_heap_allocating_helpers(fname, match):
     )
 
 
-@lint_re_check(
-    # Match sprintf/vsprintf but not snprintf/vsnprintf
-    # [^\w] ensures we don't match the safe variants
-    r"[^\w](v?sprintf)\s*\(" + CPP_RE_EOL,
-    include=cpp_include,
-)
-def lint_no_sprintf(fname, match):
-    func = match.group(1)
-    safe_func = func.replace("sprintf", "snprintf")
-    return (
-        f"{highlight(func + '()')} is not allowed in ESPHome. It has no buffer size limit "
-        f"and can cause buffer overflows.\n"
-        f"Please use one of these alternatives:\n"
-        f"  - {highlight(safe_func + '(buf, sizeof(buf), fmt, ...)')} for general formatting\n"
-        f"  - {highlight('buf_append_printf(buf, sizeof(buf), pos, fmt, ...)')} for "
-        f"offset-based formatting (also stores format strings in flash on ESP8266)\n"
-        f"(If strictly necessary, add `// NOLINT` to the end of the line)"
-    )
-
-
 @lint_content_find_check(
     "ESP_LOG",
     include=["*.h", "*.tcc"],