A 2-letter torrc file containing "Vi" causes tor to crash
The parsing of the VirtualAddrNetworkIPv[46] options crashes when the line or file ends after the option itself. (The IPv4? option can be abbreviated to "Vi").
This is an easy fix that involves checking for the empty string early on, before we assert on it in the parsing code.
Discovered using afl-fuzz with a custom tor binary that parses a torrc file from standard input (and doesn't do much else). This kind of fuzzing would be easier to conduct using a test harness, rather than using the entire tor binary.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information