Skip to content

Guard truncated Xiaomi toothbrush payloads - #1575

Merged
Ernst79 merged 1 commit into
custom-components:masterfrom
IoannisArmamentos:fix/xiaomi-obj3003-length-guard
Sep 8, 2026
Merged

Guard truncated Xiaomi toothbrush payloads#1575
Ernst79 merged 1 commit into
custom-components:masterfrom
IoannisArmamentos:fix/xiaomi-obj3003-length-guard

Conversation

@IoannisArmamentos

Copy link
Copy Markdown
Contributor

Summary

Prevent malformed Xiaomi toothbrush MiBeacon objects from raising an exception during parsing.

Problem

obj3003() parses brushing start/end events containing a one-byte event marker followed by a four-byte timestamp.

The object payload length comes from the BLE advertisement, but the parser attempted to unpack the timestamp without first verifying that the payload contained enough bytes.

A truncated object with a start or end marker could therefore raise struct.error and propagate out of the parser.

The function also contained an unconditional leftover print() statement that wrote brushing payloads to stdout.

Fix

Reject obj3003 payloads shorter than the five bytes required for the event marker and timestamp.

Valid five byte and six byte brushing payloads remain unchanged, including the optional brushing score.

The stray stdout debug print was also removed.

A regression test covers truncated obj3003 payloads.

@Ernst79
Ernst79 merged commit 4a98c1a into custom-components:master Sep 8, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants