From cc77898b95e39ebb708bdc696964e17a69159a58 Mon Sep 17 00:00:00 2001
From: PobreGato <315121269+pobregat0@users.noreply.github.com>
Date: Wed, 9 Sep 2026 19:10:29 -0400
Subject: [PATCH] check the whole block header fits before reading block size
 in ratchets payload

---
 libi2pd/ECIESX25519AEADRatchetSession.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libi2pd/ECIESX25519AEADRatchetSession.cpp b/libi2pd/ECIESX25519AEADRatchetSession.cpp
index 06e9a07c..16e9d523 100644
--- a/libi2pd/ECIESX25519AEADRatchetSession.cpp
+++ b/libi2pd/ECIESX25519AEADRatchetSession.cpp
@@ -395,7 +395,9 @@ namespace garlic
 	{
 		if (len < 3) return;
 		size_t offset = 0;
-		while (offset < len)
+		// the block header is three bytes: without all of them the size field below
+		// would be read past the end of the payload
+		while (offset + 3 <= len)
 		{
 			uint8_t blk = buf[offset];
 			offset++;