From 52974cf176522c52fe4c4d3df069773d99a94fef Mon Sep 17 00:00:00 2001
From: Taiyu Xu <xtymmms1021@gmail.com>
Date: Sun, 22 Mar 2026 15:23:38 +0900
Subject: [PATCH] fix(xiaomi): guard malformed 0x4851/0x4852 duration payloads

---
 .../ble_monitor/ble_parser/xiaomi.py          |  6 ++++++
 .../ble_monitor/test/test_xiaomi_parser.py    | 19 +++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/custom_components/ble_monitor/ble_parser/xiaomi.py b/custom_components/ble_monitor/ble_parser/xiaomi.py
index 1eeb49d2..1fb39cb0 100755
--- a/custom_components/ble_monitor/ble_parser/xiaomi.py
+++ b/custom_components/ble_monitor/ble_parser/xiaomi.py
@@ -858,12 +858,18 @@ def obj4850(xobj):
 
 def obj4851(xobj):
     """From miot-spec: has-someone-duration: uint8: 2 - 2 minutes, 5 - 5 minutes (not used)"""
+    if len(xobj) != 4:
+        return {}
+
     (duration,) = struct.unpack("<I", xobj)
     return {"duration occupancy detected": duration}
 
 
 def obj4852(xobj):
     """From miot-spec: no-one-duration: uint8: 2/5/10/30 - 2/5/10/30 minutes (not used)"""
+    if len(xobj) != 4:
+        return {}
+
     (duration,) = struct.unpack("<I", xobj)
     return {"duration no occupancy detected": duration}
 
diff --git a/custom_components/ble_monitor/test/test_xiaomi_parser.py b/custom_components/ble_monitor/test/test_xiaomi_parser.py
index fbfd4692..e374595a 100644
--- a/custom_components/ble_monitor/test/test_xiaomi_parser.py
+++ b/custom_components/ble_monitor/test/test_xiaomi_parser.py
@@ -2,11 +2,30 @@
 import datetime
 
 from ble_monitor.ble_parser import BleParser
+from ble_monitor.ble_parser.xiaomi import obj4851, obj4852
 
 
 class TestXiaomi:
     """Tests for the Xiaomi parser"""
 
+    def test_obj4851_valid_duration(self):
+        """Test obj4851 parser with a valid 4-byte payload."""
+        assert obj4851(bytes.fromhex("05000000")) == {"duration occupancy detected": 5}
+
+    def test_obj4851_invalid_duration_length(self):
+        """Test obj4851 parser with malformed payload lengths."""
+        assert obj4851(bytes.fromhex("050000")) == {}
+        assert obj4851(bytes.fromhex("0500000001")) == {}
+
+    def test_obj4852_valid_duration(self):
+        """Test obj4852 parser with a valid 4-byte payload."""
+        assert obj4852(bytes.fromhex("0a000000")) == {"duration no occupancy detected": 10}
+
+    def test_obj4852_invalid_duration_length(self):
+        """Test obj4852 parser with malformed payload lengths."""
+        assert obj4852(bytes.fromhex("0a0000")) == {}
+        assert obj4852(bytes.fromhex("0a00000001")) == {}
+
     def test_Xiaomi_LYWSDCGQ(self):
         """Test Xiaomi parser for LYWSDCGQ."""
         data_string = "043e2502010000219335342d5819020106151695fe5020aa01da219335342d580d1004fe004802c4"