Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

purplei2p/i2pd

              openssl @ f87d4c0
            

314

Fixes

CVEs

CRITICAL

Peak severity

40.6%

Coverage

Highlights

Denial of Service: 154 prior fixes. Scrutinize any change in this area.

libi2pd/SSU2Session.cpp: most-fixed (41 issues). Treat as high-risk during review.

138 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: OpenSSL EVP signature checking helpers historically accepted any non-zero or un-validated return values from functions such as EVP_DigestVerify and DSA_do_verify, resulting in signature bypasses. Robust verifier code must explicitly validate that OpenSSL APIs return exactly 1 for success.

Memory Corruption: Identity and private key parsing logic repeatedly suffered from heap and stack buffer overflows due to incorrect offset mathematics, missing input size validation, and unsafe memcpy operations into structured fields of hardcoded or unaligned sizes.

Denial of Service: SSU2 session establishment has been highly susceptible to resource exhaustion and memory bloat from unbounded packet queues, redundant connection attempts, duplicate nonces, missing session creation timeouts, and CPU-heavy tasks processing oversized or un-validated PeerTest packages.