From cf70a8d56510a5f07eff0fd773184cae14b2dcc9 Mon Sep 17 00:00:00 2001 From: dergoegge Date: Thu, 26 Oct 2023 16:50:02 +0100 Subject: [PATCH] [net] Check i2p private key constraints Co-authored-by: Vasil Dimov --- src/i2p.cpp | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/i2p.cpp b/src/i2p.cpp index 5a3dde54ced59..0641828faebee 100644 --- a/src/i2p.cpp +++ b/src/i2p.cpp @@ -351,11 +351,26 @@ Binary Session::MyDestination() const static constexpr size_t CERT_LEN_POS = 385; uint16_t cert_len; + + if (m_private_key.size() < CERT_LEN_POS + sizeof(cert_len)) { + throw std::runtime_error(strprintf("The private key is too short (%d < %d)", + m_private_key.size(), + CERT_LEN_POS + sizeof(cert_len))); + } + memcpy(&cert_len, &m_private_key.at(CERT_LEN_POS), sizeof(cert_len)); cert_len = be16toh(cert_len); const size_t dest_len = DEST_LEN_BASE + cert_len; + if (dest_len > m_private_key.size()) { + throw std::runtime_error(strprintf("Certificate length (%d) designates that the private key should " + "be %d bytes, but it is only %d bytes", + cert_len, + dest_len, + m_private_key.size())); + } + return Binary{m_private_key.begin(), m_private_key.begin() + dest_len}; }