From fb7db9ecd0be04385ad5ae40e6e802cd80bb3455 Mon Sep 17 00:00:00 2001
From: anonhelper <torcontrib@airmail.cc>
Date: Wed, 21 Oct 2020 02:07:26 +0000
Subject: Fixed out-of-bounds write in onion pool.

---
 src/common/onion.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/common/onion.c b/src/common/onion.c
index 6a61d83..d99bf5c 100644
--- a/src/common/onion.c
+++ b/src/common/onion.c
@@ -62,7 +62,7 @@ static int insert_onion_entry(struct onion_entry *entry,
 	assert(entry);
 	assert(pool);
 
-	if (pool->count > pool->size) {
+	if (pool->count >= pool->size) {
 		/* Double the size of the pool. */
 		ret = resize_onion_pool(pool, pool->size * 2);
 		if (ret < 0) {
-- 
cgit v1.2.1