From 4fdb8c7c83f302f077d6d0fcf1b679f84e5c2e0c Mon Sep 17 00:00:00 2001
From: PobreGato <315121269+pobregat0@users.noreply.github.com>
Date: Mon, 31 Aug 2026 04:28:37 +0300
Subject: [PATCH] drop a tunnel message shorter than an I2NP header

---
 libi2pd/TunnelEndpoint.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libi2pd/TunnelEndpoint.cpp b/libi2pd/TunnelEndpoint.cpp
index c8b31343..8bdb90ba 100644
--- a/libi2pd/TunnelEndpoint.cpp
+++ b/libi2pd/TunnelEndpoint.cpp
@@ -322,6 +322,12 @@ namespace tunnel
 			LogPrint (eLogInfo, "TunnelMessage: Message expired");
 			return;
 		}
+		if (msg.data->GetLength () < I2NP_HEADER_SIZE)
+		{
+			// GetPayloadLength subtracts the header size, a shorter message wraps it around
+			LogPrint (eLogError, "TunnelMessage: Message of ", msg.data->GetLength (), " bytes is shorter than I2NP header, dropped");
+			return;
+		}
 		uint8_t typeID = msg.data->GetTypeID ();
 		LogPrint (eLogDebug, "TunnelMessage: Handle fragment of ", msg.data->GetLength (), " bytes, msg type ", (int)typeID);