Bump github/codeql-action from 4.31.11 to 4.32.0

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.31.11 to 4.32.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](19b2f06db2...b20883b0cd)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/codeql.yml

@@ -58,7 +58,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4.31.11
+        uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -86,6 +86,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4.31.11
+        uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
         with:
           category: "/language:${{matrix.language}}"

esphome/components/web_server_idf/utils.cpp

@@ -78,8 +78,11 @@ optional<std::string> query_key_value(const std::string &query_url, const std::s
     return {};
   }
 
-  // Use stack buffer for typical query strings, heap fallback for large ones
-  SmallBufferWithHeapFallback<256, char> val(query_url.size());
+  auto val = std::unique_ptr<char[]>(new char[query_url.size()]);
+  if (!val) {
+    ESP_LOGE(TAG, "Not enough memory to the query key value");
+    return {};
+  }
 
   if (httpd_query_key_value(query_url.c_str(), key.c_str(), val.get(), query_url.size()) != ESP_OK) {
     return {};

esphome/components/web_server_idf/web_server_idf.cpp

@@ -352,15 +352,14 @@ bool AsyncWebServerRequest::authenticate(const char *username, const char *passw
   memcpy(user_info + user_len + 1, password, pass_len);
   user_info[user_info_len] = '\0';
 
-  // Base64 output size is ceil(input_len * 4/3) + 1, with input bounded to 256 bytes
-  // max output is ceil(256 * 4/3) + 1 = 343 bytes, use 350 for safety
-  constexpr size_t max_digest_len = 350;
-  char digest[max_digest_len];
-  size_t out;
-  esp_crypto_base64_encode(reinterpret_cast<uint8_t *>(digest), max_digest_len, &out,
+  size_t n = 0, out;
+  esp_crypto_base64_encode(nullptr, 0, &n, reinterpret_cast<const uint8_t *>(user_info), user_info_len);
+
+  auto digest = std::unique_ptr<char[]>(new char[n + 1]);
+  esp_crypto_base64_encode(reinterpret_cast<uint8_t *>(digest.get()), n, &out,
                            reinterpret_cast<const uint8_t *>(user_info), user_info_len);
 
-  return strcmp(digest, auth_str + auth_prefix_len) == 0;
+  return strcmp(digest.get(), auth_str + auth_prefix_len) == 0;
 }
 
 void AsyncWebServerRequest::requestAuthentication(const char *realm) const {
@@ -870,12 +869,12 @@ esp_err_t AsyncWebServer::handle_multipart_upload_(httpd_req_t *r, const char *c
     }
   });
 
-  // Process data - use stack buffer to avoid heap allocation
-  char buffer[MULTIPART_CHUNK_SIZE];
+  // Process data
+  std::unique_ptr<char[]> buffer(new char[MULTIPART_CHUNK_SIZE]);
   size_t bytes_since_yield = 0;
 
   for (size_t remaining = r->content_len; remaining > 0;) {
-    int recv_len = httpd_req_recv(r, buffer, std::min(remaining, MULTIPART_CHUNK_SIZE));
+    int recv_len = httpd_req_recv(r, buffer.get(), std::min(remaining, MULTIPART_CHUNK_SIZE));
 
     if (recv_len <= 0) {
       httpd_resp_send_err(r, recv_len == HTTPD_SOCK_ERR_TIMEOUT ? HTTPD_408_REQ_TIMEOUT : HTTPD_400_BAD_REQUEST,
@@ -883,7 +882,7 @@ esp_err_t AsyncWebServer::handle_multipart_upload_(httpd_req_t *r, const char *c
       return recv_len == HTTPD_SOCK_ERR_TIMEOUT ? ESP_ERR_TIMEOUT : ESP_FAIL;
     }
 
-    if (reader->parse(buffer, recv_len) != static_cast<size_t>(recv_len)) {
+    if (reader->parse(buffer.get(), recv_len) != static_cast<size_t>(recv_len)) {
       ESP_LOGW(TAG, "Multipart parser error");
       httpd_resp_send_err(r, HTTPD_400_BAD_REQUEST, nullptr);
       return ESP_FAIL;