From 954e98eb4d9b62fd1daa9bfa5af310b80263504f Mon Sep 17 00:00:00 2001
From: PobreGato <315121269+pobregat0@users.noreply.github.com>
Date: Mon, 31 Aug 2026 03:00:47 +0300
Subject: [PATCH] fail on a truncated chunk instead of returning uninitialized
 bytes

---
 libi2pd/HTTP.cpp                  | 5 +++++
 tests/test-http-merge_chunked.cpp | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/libi2pd/HTTP.cpp b/libi2pd/HTTP.cpp
index 03321cf5..f5c0b213 100644
--- a/libi2pd/HTTP.cpp
+++ b/libi2pd/HTTP.cpp
@@ -616,6 +616,11 @@ namespace http
 				return false; /* too large chunk */
 			char * buf = new char[len];
 			in.read (buf, len);
+			if (in.gcount () != len) /* chunk is shorter than announced */
+			{
+				delete[] buf;
+				return false;
+			}
 			out.write (buf, len);
 			delete[] buf;
 			std::getline (in, hexLen); // read \r\n after chunk
diff --git a/tests/test-http-merge_chunked.cpp b/tests/test-http-merge_chunked.cpp
index 31b6a298..bdba5c3b 100644
--- a/tests/test-http-merge_chunked.cpp
+++ b/tests/test-http-merge_chunked.cpp
@@ -21,5 +21,11 @@ int main() {
   assert(MergeChunkedResponse(in, out) == true);
   assert(out.str() == "HTTP response with \r\nchunks.");
 
+  /* a chunk that promises more bytes than the response carries */
+  std::stringstream truncated("20\r\nshort\r\n");
+  std::stringstream out2;
+
+  assert(MergeChunkedResponse(truncated, out2) == false);
+
   return 0;
 }