From cf70a8d56510a5f07eff0fd773184cae14b2dcc9 Mon Sep 17 00:00:00 2001
From: dergoegge <n.goeggi@gmail.com>
Date: Thu, 26 Oct 2023 16:50:02 +0100
Subject: [net] Check i2p private key constraints

Co-authored-by: Vasil Dimov <vd@FreeBSD.org>
---
 src/i2p.cpp | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/i2p.cpp b/src/i2p.cpp
index 5a3dde54ce..0641828fae 100644
--- a/src/i2p.cpp
+++ b/src/i2p.cpp
@@ -351,11 +351,26 @@ Binary Session::MyDestination() const
     static constexpr size_t CERT_LEN_POS = 385;
 
     uint16_t cert_len;
+
+    if (m_private_key.size() < CERT_LEN_POS + sizeof(cert_len)) {
+        throw std::runtime_error(strprintf("The private key is too short (%d < %d)",
+                                           m_private_key.size(),
+                                           CERT_LEN_POS + sizeof(cert_len)));
+    }
+
     memcpy(&cert_len, &m_private_key.at(CERT_LEN_POS), sizeof(cert_len));
     cert_len = be16toh(cert_len);
 
     const size_t dest_len = DEST_LEN_BASE + cert_len;
 
+    if (dest_len > m_private_key.size()) {
+        throw std::runtime_error(strprintf("Certificate length (%d) designates that the private key should "
+                                           "be %d bytes, but it is only %d bytes",
+                                           cert_len,
+                                           dest_len,
+                                           m_private_key.size()));
+    }
+
     return Binary{m_private_key.begin(), m_private_key.begin() + dest_len};
 }
 
-- 
cgit v1.2.3


From 5cf4d266d9b1e7bd9394e7581398de5bc540ae99 Mon Sep 17 00:00:00 2001
From: Vasil Dimov <vd@FreeBSD.org>
Date: Thu, 26 Oct 2023 16:52:04 +0100
Subject: [test] Test i2p private key constraints

---
 src/test/i2p_tests.cpp | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/src/test/i2p_tests.cpp b/src/test/i2p_tests.cpp
index b2e1ae43be..ecbdc88bb9 100644
--- a/src/test/i2p_tests.cpp
+++ b/src/test/i2p_tests.cpp
@@ -9,6 +9,7 @@
 #include <test/util/logging.h>
 #include <test/util/net.h>
 #include <test/util/setup_common.h>
+#include <util/readwritefile.h>
 #include <util/threadinterrupt.h>
 
 #include <boost/test/unit_test.hpp>
@@ -45,4 +46,47 @@ BOOST_AUTO_TEST_CASE(unlimited_recv)
     LogInstance().SetLogLevel(prev_log_level);
 }
 
+BOOST_AUTO_TEST_CASE(damaged_private_key)
+{
+    const auto CreateSockOrig = CreateSock;
+
+    CreateSock = [](const CService&) {
+        return std::make_unique<StaticContentsSock>("HELLO REPLY RESULT=OK VERSION=3.1\n"
+                                                    "SESSION STATUS RESULT=OK DESTINATION=\n");
+    };
+
+    const auto i2p_private_key_file = m_args.GetDataDirNet() / "test_i2p_private_key_damaged";
+
+    for (const auto& [file_contents, expected_error] : std::vector<std::tuple<std::string, std::string>>{
+             {"", "The private key is too short (0 < 387)"},
+
+             {"abcd", "The private key is too short (4 < 387)"},
+
+             {std::string(386, '\0'), "The private key is too short (386 < 387)"},
+
+             {std::string(385, '\0') + '\0' + '\1',
+              "Certificate length (1) designates that the private key should be 388 bytes, but it is only "
+              "387 bytes"},
+
+             {std::string(385, '\0') + '\0' + '\5' + "abcd",
+              "Certificate length (5) designates that the private key should be 392 bytes, but it is only "
+              "391 bytes"}}) {
+        BOOST_REQUIRE(WriteBinaryFile(i2p_private_key_file, file_contents));
+
+        CThreadInterrupt interrupt;
+        i2p::sam::Session session(i2p_private_key_file, CService{}, &interrupt);
+
+        {
+            ASSERT_DEBUG_LOG("Creating persistent SAM session");
+            ASSERT_DEBUG_LOG(expected_error);
+
+            i2p::Connection conn;
+            bool proxy_error;
+            BOOST_CHECK(!session.Connect(CService{}, conn, proxy_error));
+        }
+    }
+
+    CreateSock = CreateSockOrig;
+}
+
 BOOST_AUTO_TEST_SUITE_END()
-- 
cgit v1.2.3