dandri/i2pd
1
0
Fork 0
mirror of https://github.com/PurpleI2P/i2pd.git synced 2026-07-28 10:09:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix buffer overflow on large SSU2 first fragment and I2NP blocks

Browse Source
This commit is contained in:
acetone
2026-07-20 10:52:08 +03:00
parent 5f6ee84c1f
commit 2582103d1d
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libi2pd/SSU2Session.cpp
+10
View File
@@ -1784,6 +1784,11 @@ namespace transport
{
LogPrint (eLogDebug, "SSU2: I2NP message");
auto nextMsg = (buf[offset] == eI2NPTunnelData) ? NewI2NPTunnelMessage (true) : NewI2NPShortMessage ();
if (nextMsg->offset + size + 7 > nextMsg->maxLen) // 7 more bytes for full I2NP header
{
LogPrint (eLogWarning, "SSU2: I2NP message block size ", size, " exceeds max message size ", nextMsg->maxLen);
break;
}
nextMsg->len = nextMsg->offset + size + 7; // 7 more bytes for full I2NP header
memcpy (nextMsg->GetNTCP2Header (), buf + offset, size);
nextMsg->FromNTCP2 (); // SSU2 has the same format as NTCP2
@@ -2119,6 +2124,11 @@ namespace transport
void SSU2Session::HandleFirstFragment (const uint8_t * buf, size_t len)
{
auto msg = (buf[0] == eI2NPTunnelData) ? NewI2NPTunnelMessage (true) : NewI2NPShortMessage ();
if (msg->offset + len + 7 > msg->maxLen)
{
LogPrint (eLogWarning, "SSU2: First fragment size ", len, " exceeds max message size ", msg->maxLen);
return;
}
uint32_t msgID; memcpy (&msgID, buf + 1, 4);
// same format as I2NP message block
msg->len = msg->offset + len + 7;