Out of bounds write on directory authorities when voting on duplicate ed25519 keys
In dirserv_compute_performance_thresholds, we allocate arrays based on the length of 'routers', a list of routerinfo_t, but loop over the nodelist. The 'routers' list may be shorter when relays were filtered by routers_make_ed_keys_unique, leading to an out-of-bounds write.
This bug was originally introduced in 26e89742, but it doesn't look possible to trigger until routers_make_ed_keys_unique was introduced in 13a31e72.
This needs a backport to 0.2.7, but wasn't in a released version. Fix on 0.2.8.2-alpha.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information