From a5d4896a5c5c775fa60c0b435d27e6ab226db6a2 Mon Sep 17 00:00:00 2001
From: acetone <63557806+freeacetone@users.noreply.github.com>
Date: Mon, 14 Sep 2026 14:45:39 -0400
Subject: [PATCH] check outer plaintext length in encrypted LeaseSet2

---
 libi2pd/LeaseSet.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libi2pd/LeaseSet.cpp b/libi2pd/LeaseSet.cpp
index ab73d9c4..7934abde 100644
--- a/libi2pd/LeaseSet.cpp
+++ b/libi2pd/LeaseSet.cpp
@@ -573,6 +573,11 @@ namespace data
 			// keys = HKDF(innerSalt, innerInput, "ELS2_L2K", 44)
 			uint8_t innerInput[68];
 			size_t authDataLen = ExtractClientAuthData (outerPlainText.data (), lenOuterPlaintext, secret, subcredential, innerInput);
+			if (lenOuterPlaintext < authDataLen + 34) // flag + authData + inner salt + at least one byte of inner plaintext
+			{
+				LogPrint (eLogError, "LeaseSet2: Outer plaintext is too short ", lenOuterPlaintext);
+				return;
+			}
 			if (authDataLen > 0)
 			{
 				memcpy (innerInput + 32, subcredential, 36);