diff -U2 -r /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/Datagram.cpp /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/Datagram.cpp --- /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/Datagram.cpp 2026-08-23 18:40:07.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/Datagram.cpp 2026-08-23 18:38:37.000000000 +0000 @@ -244,7 +244,7 @@ } } - if (offset > len || signatureLen > len - offset) + if (offset > len) { - LogPrint (eLogWarning, "Datagram: datagram2 is too short ", len, " expected ", offset + signatureLen); + LogPrint (eLogWarning, "Datagram: datagram2 is too short ", len, " expected ", offset); return; } @@ -262,9 +262,4 @@ signatureLen = transientVerifier->GetSignatureLen (); } - if (offset > len || signatureLen > len - offset) - { - LogPrint (eLogWarning, "Datagram: datagram2 is too short ", len, " expected ", offset + signatureLen); - return; - } std::vector signedData (len + 32 - identityLen - signatureLen); memcpy (signedData.data (), identity.GetIdentHash (), 32); diff -U2 -r /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/NTCP2.cpp /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/NTCP2.cpp --- /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/NTCP2.cpp 2026-08-23 18:40:07.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/NTCP2.cpp 2026-08-23 18:38:37.000000000 +0000 @@ -1339,9 +1339,4 @@ break; } - if (size < 9) - { - LogPrint (eLogError, "NTCP2: I2NP block is too short ", size); - break; - } auto nextMsg = (frame[offset] == eI2NPTunnelData) ? NewI2NPTunnelMessage (true) : NewI2NPMessage (size); nextMsg->len = nextMsg->offset + size + 7; // 7 more bytes for full I2NP header diff -U2 -r /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/NetDb.cpp /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/NetDb.cpp --- /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/NetDb.cpp 2026-08-23 18:40:07.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/NetDb.cpp 2026-08-23 18:38:37.000000000 +0000 @@ -805,5 +805,5 @@ { const uint8_t * buf = m->GetPayload (); - size_t len = m->GetPayloadLength (); + size_t len = m->GetSize (); if (len < DATABASE_STORE_HEADER_SIZE) { @@ -965,10 +965,4 @@ LogPrint (eLogDebug, "NetDb: DatabaseLookup for ", key, " received flags=", (int)flag); uint8_t lookupType = flag & DATABASE_LOOKUP_TYPE_FLAGS_MASK; - size_t minLen = 65 + ((flag & DATABASE_LOOKUP_DELIVERY_FLAG) ? 4 : 0) + 2; - if (msg->GetPayloadLength () < minLen) - { - LogPrint (eLogWarning, "NetDb: DatabaseLookup message is too short for its flags"); - return; - } const uint8_t * excluded = buf + 65; uint32_t replyTunnelID = 0; @@ -1068,32 +1062,25 @@ if (flag & (DATABASE_LOOKUP_ENCRYPTION_FLAG | DATABASE_LOOKUP_ECIES_FLAG)) // encrypted reply requested { - // session key (32) + numTags (1), then the tag itself: 8 bytes for ECIES, 32 for ElGamal - size_t tagLen = (flag & DATABASE_LOOKUP_ECIES_FLAG) ? 8 : 32; - if ((size_t)(excluded - buf) + 33 + tagLen > msg->GetPayloadLength ()) - LogPrint (eLogWarning, "NetDb: DatabaseLookup reply key block is truncated"); - else + const uint8_t * sessionKey = excluded; + const uint8_t numTags = excluded[32]; + if (numTags) { - const uint8_t * sessionKey = excluded; - const uint8_t numTags = excluded[32]; - if (numTags) + if (flag & DATABASE_LOOKUP_ECIES_FLAG) { - if (flag & DATABASE_LOOKUP_ECIES_FLAG) - { - uint64_t tag; - memcpy (&tag, excluded + 33, 8); - replyMsg = i2p::garlic::WrapECIESX25519Message (replyMsg, sessionKey, tag); - } - else - { - const i2p::garlic::SessionTag sessionTag(excluded + 33); // take first tag - i2p::garlic::ElGamalAESSession garlic (sessionKey, sessionTag); - replyMsg = garlic.WrapSingleMessage (replyMsg); - } - if (!replyMsg) - LogPrint (eLogError, "NetDb: Failed to wrap message"); + uint64_t tag; + memcpy (&tag, excluded + 33, 8); + replyMsg = i2p::garlic::WrapECIESX25519Message (replyMsg, sessionKey, tag); } else - LogPrint(eLogWarning, "NetDb: Encrypted reply requested but no tags provided"); + { + const i2p::garlic::SessionTag sessionTag(excluded + 33); // take first tag + i2p::garlic::ElGamalAESSession garlic (sessionKey, sessionTag); + replyMsg = garlic.WrapSingleMessage (replyMsg); + } + if (!replyMsg) + LogPrint (eLogError, "NetDb: Failed to wrap message"); } + else + LogPrint(eLogWarning, "NetDb: Encrypted reply requested but no tags provided"); } bool direct = true; diff -U2 -r /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/RouterInfo.cpp /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/RouterInfo.cpp --- /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/RouterInfo.cpp 2026-08-23 18:40:07.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/RouterInfo.cpp 2026-08-23 18:38:37.000000000 +0000 @@ -325,5 +325,5 @@ else if (address->transportStyle == eTransportSSU2) { - if (value.size () == 1 && value[0] >= '3' && value[0] <= '4') // only 3,4 allowed, TODO: support multiple values + if (value[0] >= '3' && value[0] <= '4') // only 3,4 allowed, TODO: support multiple values address->v = value[0] - '0'; } diff -U2 -r /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/SSU2Session.cpp /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/SSU2Session.cpp --- /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/SSU2Session.cpp 2026-08-23 18:40:07.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/SSU2Session.cpp 2026-08-23 18:38:37.000000000 +0000 @@ -1708,7 +1708,7 @@ uint32_t SSU2Session::SendData (const uint8_t * buf, size_t len, uint8_t flags) { - if (len < 8 || len + 16 > SSU2_MAX_PACKET_SIZE) + if (len < 8) { - LogPrint (eLogWarning, "SSU2: Data message payload length ", (int)len, " is out of range"); + LogPrint (eLogWarning, "SSU2: Data message payload is too short ", (int)len); return 0; } @@ -1722,9 +1722,5 @@ CreateNonce (m_SendPacketNum, nonce); uint8_t payload[SSU2_MAX_PACKET_SIZE]; - if (!m_Server.AEADChaCha20Poly1305Encrypt (buf, len, header.buf, 16, m_KeyDataSend, nonce, payload, SSU2_MAX_PACKET_SIZE)) - { - LogPrint (eLogError, "SSU2: Data message AEAD encryption failed"); - return 0; - } + m_Server.AEADChaCha20Poly1305Encrypt (buf, len, header.buf, 16, m_KeyDataSend, nonce, payload, SSU2_MAX_PACKET_SIZE); header.ll[0] ^= CreateHeaderMask (m_Address->i, payload + (len - 8)); header.ll[1] ^= CreateHeaderMask (m_KeyDataSend + 32, payload + (len + 4)); @@ -1809,10 +1805,4 @@ { LogPrint (eLogDebug, "SSU2: I2NP message"); - if (size < 9) - { - LogPrint (eLogWarning, "SSU2: I2NP message block size ", size, " is too short"); - m_IsInvalidMessage = true; - break; - } auto nextMsg = (buf[offset] == eI2NPTunnelData) ? NewI2NPTunnelMessage (true) : NewI2NPShortMessage (); if (nextMsg->offset + size + 7 > nextMsg->maxLen) // 7 more bytes for full I2NP header @@ -2168,10 +2158,4 @@ void SSU2Session::HandleFirstFragment (const uint8_t * buf, size_t len) { - if (len < 9) - { - LogPrint (eLogWarning, "SSU2: First fragment size ", len, " is too short"); - m_IsInvalidMessage = true; - return; - } auto msg = (buf[0] == eI2NPTunnelData) ? NewI2NPTunnelMessage (true) : NewI2NPShortMessage (); if (msg->offset + len + 7 > msg->maxLen) @@ -2451,10 +2435,4 @@ { // we are Bob, message from Charlie - size_t maxPayloadSize = relaySession->GetMaxPayloadSize (); - if (len + 3 > maxPayloadSize) - { - LogPrint (eLogWarning, "SSU2: RelayResponse block size ", len, " is too long"); - return; - } auto packet = m_Server.GetSentPacketsPool ().AcquireShared (); uint8_t * payload = packet->payload; @@ -2463,5 +2441,5 @@ memcpy (payload + 3, buf, len); // forward to Alice as is packet->payloadSize = len + 3; - packet->payloadSize += CreatePaddingBlock (payload + packet->payloadSize, maxPayloadSize - packet->payloadSize); + packet->payloadSize += CreatePaddingBlock (payload + packet->payloadSize, m_MaxPayloadSize - packet->payloadSize); uint32_t packetNum = relaySession->SendData (packet->payload, packet->payloadSize); if (m_RemoteVersion >= SSU2_MIN_RELAY_RESPONSE_RESEND_VERSION) diff -U2 -r /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/Streaming.cpp /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/Streaming.cpp --- /var/lib/copr-rpmbuild/results/i2pd-git/upstream-unpacked/Source0/i2pd-openssl/libi2pd/Streaming.cpp 2026-08-23 18:40:07.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/i2pd-git/srpm-unpacked/i2pd-openssl.tar.gz-extract/i2pd-openssl/libi2pd/Streaming.cpp 2026-08-23 18:38:37.000000000 +0000 @@ -1009,5 +1009,5 @@ numMsgs = m_NumPacketsToSend; - if (!m_RemoteLeaseSet && m_RemoteIdentity) m_RemoteLeaseSet = m_LocalDestination.GetOwner ()->FindLeaseSet (m_RemoteIdentity->GetIdentHash ()); + if (!m_RemoteLeaseSet) m_RemoteLeaseSet = m_LocalDestination.GetOwner ()->FindLeaseSet (m_RemoteIdentity->GetIdentHash ()); if (m_RemoteLeaseSet) { @@ -1083,5 +1083,5 @@ // initial packet m_Status = eStreamStatusOpen; - if (!m_RemoteLeaseSet && m_RemoteIdentity) m_RemoteLeaseSet = m_LocalDestination.GetOwner ()->FindLeaseSet (m_RemoteIdentity->GetIdentHash ()); + if (!m_RemoteLeaseSet) m_RemoteLeaseSet = m_LocalDestination.GetOwner ()->FindLeaseSet (m_RemoteIdentity->GetIdentHash ()); if (m_RemoteLeaseSet) { @@ -1973,11 +1973,4 @@ if (!m_RemoteLeaseSet || m_RemoteLeaseSet->IsExpired ()) { - if (!m_RemoteIdentity) - { - // no remote identity established yet, nothing to look up - m_Status = eStreamStatusClosed; - AsyncClose (); - return; - } auto remoteLeaseSet = m_LocalDestination.GetOwner ()->FindLeaseSet (m_RemoteIdentity->GetIdentHash ()); if (!remoteLeaseSet)