GitLab

If payload length for EXTEND2 cell is zero then extend_cell_parse() still tries to parse it by:

uint8_t n_specs = *payload

This bug should be harmless as

 if (eop - payload < 2)

still true.

Fixed code should be looking like:

uint8_t n_specs = 0;
...
if (eop - payload > 0)
  ++payload;
...

or

uint8_t n_specs;
...
if (eop - payload < 1)
  return -1;
cell_out->cell_type = RELAY_COMMAND_EXTEND2;
++payload;

or like dropping cell for any cell type if zero length.

int
extend_cell_parse(extend_cell_t *cell_out, const uint8_t command,
                  const uint8_t *payload, size_t payload_length)
{
  const uint8_t *eop;

  memset(cell_out, 0, sizeof(*cell_out));
  if (payload_length > RELAY_PAYLOAD_SIZE || 0 == payload_length)
    return -1;

or something.