PobreGatoandClaude Opus 5 466e865e91 LeaseSet2: check declared key length before creating an encryptor ...

A key section in a standard LeaseSet2 carries both a key type and a key
length. The length is checked against the buffer, but the encryptor reads
a length fixed by the type instead: 256 bytes for ElGamal, 64 for ECIES
P256, 32 for X25519. A section that declares ElGamal with a length of zero
passes the check and then makes CreateEncryptor read 256 bytes past the end
of the message.

Key sections are parsed before the signature is verified, so no key material
is needed to trigger it.

GetCryptoPublicKeyLen returned 32 for ECIES P256, while the key is x and y,
32 bytes each; without fixing that too, the new check would still let a 32
byte P256 section through.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Awv7FvZTpGFsKFNeNyJaTE

2026-09-14 21:43:53 -04:00

..

api.cpp

use Mapping for local destination params

2025-10-13 17:33:53 -04:00

api.h

EdDSA signature type by default

2026-07-24 17:49:31 -04:00

Base.cpp

use base64 from boost::beast for basic authorization

2026-08-16 03:56:58 +03:00

Base.h

use base64 from boost::beast for basic authorization

2026-08-16 03:56:58 +03:00

Blinding.cpp

chore: fix memory safety issues

2026-08-18 15:43:44 -04:00

Blinding.h

chore: fix memory safety issues

2026-08-18 15:43:44 -04:00

Config.cpp

http.javascript config param

2026-08-24 18:16:50 -04:00

Config.h

chore: fix issues found through static analysis

2026-07-25 16:42:55 -04:00

CPU.h

always use openssl for AES

2024-12-06 20:25:22 -05:00

Crypto.cpp

common HKDF context for ratchets tags

2026-08-08 16:52:28 -04:00

Crypto.h

common HKDF context for ratchets tags

2026-08-08 16:52:28 -04:00

CryptoKey.cpp

libi2pd: fix some typos

2026-07-24 20:45:35 -04:00

CryptoKey.h

LeaseSet2: check declared key length before creating an encryptor

2026-09-14 21:43:53 -04:00

Datagram.cpp

check datagram sessions for empty under the lock

2026-09-03 01:58:09 +03:00

Datagram.h

correct signature for datagram2

2026-08-30 13:24:40 -04:00

Destination.cpp

check clove length before reading delivery status and tunnel test

2026-09-14 14:45:13 -04:00

Destination.h

support C++20 with older boost

2026-09-07 22:55:21 -04:00

ECIESX25519AEADRatchetSession.cpp

chech ratchets payload size and key

2026-09-09 09:23:18 -04:00

ECIESX25519AEADRatchetSession.h

fix typos

2026-08-12 19:27:06 +03:00

Ed25519.cpp

use EVP_Digest_ insted deprecated SHA512_ functions

2025-06-18 13:19:49 -04:00

Ed25519.h

removed own implementation of x25519

2024-11-01 17:53:27 -04:00

Elligator.cpp

cleanup code (spaces, tabs)

2022-05-20 17:44:29 +00:00

Elligator.h

add copyright headers

2020-05-22 18:14:53 +00:00

Family.cpp

chore: fix more memory safety issues

2026-07-25 11:34:36 -04:00

Family.h

always pass RouterInfo param values as string_view

2025-02-19 11:08:47 -05:00

FS.cpp

removed CreatePath

2026-08-23 14:58:28 -04:00

FS.h

removed CreatePath

2026-08-23 14:58:28 -04:00

Garlic.cpp

common GetRngSeed to initialize std::mt19937

2026-08-21 10:51:44 -04:00

Garlic.h

http, i2pcontrol: use thread-safe snapshots for session/tunnel lists

2026-08-24 10:20:04 -04:00

Gost.cpp

Update deprecated openssl functions and remove warning suppression

2025-07-14 08:43:28 +00:00

Gost.h

add copyright headers

2020-05-22 18:14:53 +00:00

Gzip.cpp

chore: fix more memory safety issues

2026-07-25 11:34:36 -04:00

Gzip.h

fixed api/tests build error

2026-06-17 20:15:58 -04:00

HTTP.cpp

return false instead of throwing on a url with nothing after the schema

2026-08-31 03:12:39 +03:00

HTTP.h

create_query

2026-07-26 14:11:18 -04:00

I2NPProtocol.cpp

generate msgid from instead RAND_bytes

2026-08-08 14:38:11 -04:00

I2NPProtocol.h

generate msgid from instead RAND_bytes

2026-08-08 14:38:11 -04:00

I2PEndian.cpp

set of updates:

2022-02-18 09:20:06 +03:00

I2PEndian.h

libi2pd: fix some typos

2026-07-24 20:45:35 -04:00

Identity.cpp

refresh offline transient on destination service

2026-06-22 21:57:06 +03:00

Identity.h

refresh offline transient on destination service

2026-06-22 21:57:06 +03:00

IdentMetrics.cpp

inbound.randomKey and outbound.randomKey I2CP params

2026-06-13 15:27:57 -04:00

IdentMetrics.h

inbound.randomKey and outbound.randomKey I2CP params

2026-06-13 15:27:57 -04:00

KadDHT.cpp

Fix typos

2023-03-26 01:48:22 +00:00

KadDHT.h

use DHT table for floodfills

2023-02-22 15:58:20 -05:00

LeaseSet.cpp

LeaseSet2: check declared key length before creating an encryptor

2026-09-14 21:43:53 -04:00

LeaseSet.h

don't try to parse meta LeaseSet

2026-09-10 20:07:06 -04:00

LittleBigEndian.h

add copyright headers

2020-05-22 18:14:53 +00:00

Log.cpp

Fix thread-unsafe localtime()

2026-01-07 20:24:59 +03:00

Log.h

removed C++17 check

2024-09-02 18:22:33 -04:00

NetDb.cpp

support C++20 with older boost

2026-09-07 22:55:21 -04:00

NetDb.hpp

select OBEP/IBGW based on peer ordering key for low bandwidth tunnels

2026-05-27 20:14:07 -04:00

NetDbRequests.cpp

common GetRngSeed to initialize std::mt19937

2026-08-21 10:51:44 -04:00

NetDbRequests.h

Replace deadline_timer by steady_timer

2026-03-06 10:55:47 +03:00

NTCP2.cpp

don't add session if server is not ready

2026-09-07 20:23:57 -04:00

NTCP2.h

don't connect or accept sessions during start/stop

2026-09-07 09:17:13 -04:00

PostQuantum.cpp

fix typos

2026-08-12 19:27:06 +03:00

PostQuantum.h

always set MLKEM type ML-KEM-768 for libressl

2026-06-08 09:36:57 -04:00

Profiling.cpp

common GetRngSeed to initialize std::mt19937

2026-08-21 12:51:05 -04:00

Profiling.h

count non replied tunnel requests per hop

2026-02-14 15:13:20 -05:00

Queue.h

GetSize returns size_t instead int

2026-02-28 21:27:42 -05:00

Reseed.cpp

treat reseed connect timeout as a failure instead of a connection

2026-09-09 20:35:08 -04:00

Reseed.h

try to reseed again after 30 second if failed

2026-04-26 15:17:57 -04:00

RouterContext.cpp

fixed race condtion with local RouterInfo properties

2026-08-12 16:43:22 -04:00

RouterContext.h

support C++20 with older boost

2026-09-07 22:55:21 -04:00

RouterInfo.cpp

libi2pd: fix parsing crashes

2026-08-23 13:27:13 -04:00

RouterInfo.h

support C++20 with older boost

2026-09-07 22:55:21 -04:00

Signature.cpp

НЕТРОГАТЬ ФАЙЛИК

2026-06-08 11:19:39 +00:00

Signature.h

delete ECDSA private key BIGNUM if non-openssl or older openssl crypto library

2026-07-24 17:56:41 -04:00

Siphash.h

…

Socks5.h

fixed warning

2024-02-14 21:58:03 -05:00

SSU2.cpp

common GetRngSeed to initialize std::mt19937

2026-08-21 10:51:44 -04:00

SSU2.h

fix data race on sessions map in SSU2 server

2026-07-22 02:29:03 +03:00

SSU2OutOfSession.cpp

chore: fix memory leaks

2026-07-25 17:36:08 -04:00

SSU2OutOfSession.h

Replace deadline_timer by steady_timer

2026-03-06 10:55:47 +03:00

SSU2Session.cpp

require a full range pair in SSU2 ack block

2026-09-14 14:45:39 -04:00

SSU2Session.h

ban router on invalid block in SSU2 SessionConfirmed

2026-07-20 14:31:11 +03:00

Streaming.cpp

don't send packets from a terminated stream

2026-09-02 01:37:06 +03:00

Streaming.h

use std::list for receive queue

2026-08-22 22:53:48 -04:00

Tag.h

compare tags by value in ordered containers

2026-08-18 03:06:31 +03:00

Timestamp.cpp

support C++20 with older boost

2026-09-07 22:55:21 -04:00

Timestamp.h

support C++20 with older boost

2026-09-07 22:55:21 -04:00

TransitTunnel.cpp

http, i2pcontrol: use thread-safe snapshots for session/tunnel lists

2026-08-24 10:20:04 -04:00

TransitTunnel.h

http, i2pcontrol: use thread-safe snapshots for session/tunnel lists

2026-08-24 10:20:04 -04:00

Transports.cpp

common GetRngSeed to initialize std::mt19937

2026-08-21 10:51:44 -04:00

Transports.h

support C++20 with older boost

2026-09-07 22:55:21 -04:00

TransportSession.h

count sessions from same network

2026-03-23 21:33:50 -04:00

Tunnel.cpp

http, i2pcontrol: use thread-safe snapshots for session/tunnel lists

2026-08-24 10:20:04 -04:00

Tunnel.h

http, i2pcontrol: use thread-safe snapshots for session/tunnel lists

2026-08-24 10:20:04 -04:00

TunnelBase.cpp

send tunnel endpoint data to transport session to gateway directly

2024-12-17 20:50:54 -05:00

TunnelBase.h

show next peer and connectivity on transit tunnels page

2024-12-16 19:49:14 -05:00

TunnelConfig.cpp

chore: fix issues found through static analysis

2026-07-25 16:42:55 -04:00

TunnelConfig.h

chore: fix issues found through static analysis

2026-07-25 16:42:55 -04:00

TunnelEndpoint.cpp

drop a tunnel message shorter than an I2NP header

2026-08-31 04:28:37 +03:00

TunnelEndpoint.h

fix typo

2025-02-09 14:20:56 +03:00

TunnelGateway.cpp

common GetRngSeed to initialize std::mt19937

2026-08-21 10:51:44 -04:00

TunnelGateway.h

use std::mt19937 instead RAND_bytes

2026-08-20 21:42:05 -04:00

TunnelPool.cpp

common GetRngSeed to initialize std::mt19937

2026-08-21 10:51:44 -04:00

TunnelPool.h

http, i2pcontrol: use thread-safe snapshots for session/tunnel lists

2026-08-24 10:20:04 -04:00

util.cpp

support C++20 with older boost

2026-09-07 22:55:21 -04:00

util.h

common GetRngSeed to initialize std::mt19937

2026-08-21 10:51:44 -04:00

version.h

2.61.0

2026-07-18 07:39:26 -04:00