From bed01da345c6c652ef464d800aa2c8152c9681a8 Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Mon, 9 Feb 2026 03:45:40 -0600
Subject: [PATCH] [api] Guard varint parsing against overlong encodings
 (#13870)

---
 esphome/components/api/proto.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/esphome/components/api/proto.h b/esphome/components/api/proto.h
index 92978f765f..41ea0043f9 100644
--- a/esphome/components/api/proto.h
+++ b/esphome/components/api/proto.h
@@ -112,8 +112,12 @@ class ProtoVarInt {
     uint64_t result = buffer[0] & 0x7F;
     uint8_t bitpos = 7;
 
+    // A 64-bit varint is at most 10 bytes (ceil(64/7)). Reject overlong encodings
+    // to avoid undefined behavior from shifting uint64_t by >= 64 bits.
+    uint32_t max_len = std::min(len, uint32_t(10));
+
     // Start from the second byte since we've already processed the first
-    for (uint32_t i = 1; i < len; i++) {
+    for (uint32_t i = 1; i < max_len; i++) {
       uint8_t val = buffer[i];
       result |= uint64_t(val & 0x7F) << uint64_t(bitpos);
       bitpos += 7;