fix termination block processing and size check

libi2pd/NTCP2.cpp

@@ -884,7 +884,7 @@ namespace transport
 			auto size = bufbe16toh (frame + offset);
 			offset += 2;
 			LogPrint (eLogDebug, "NTCP2: Block type ", (int)blk, " of size ", size);
-			if (size > len)
+			if (offset + size > len)
 			{
 				LogPrint (eLogError, "NTCP2: Unexpected block length ", size);
 				break;

libi2pd/SSU2Session.cpp

@@ -1486,7 +1486,7 @@ namespace transport
 			auto size = bufbe16toh (buf + offset);
 			offset += 2;
 			LogPrint (eLogDebug, "SSU2: Block type ", (int)blk, " of size ", size);
-			if (size > len)
+			if (offset + size > len)
 			{
 				LogPrint (eLogError, "SSU2: Unexpected block length ", size);
 				break;
@@ -1532,7 +1532,9 @@ namespace transport
 				break;
 				case eSSU2BlkTermination:
 				{
-					uint8_t rsn = buf[11]; // reason
+					if (size >= 9)
+					{
+						uint8_t rsn = buf[offset + 8]; // reason
 						LogPrint (eLogDebug, "SSU2: Termination reason=", (int)rsn);
 						if (IsEstablished () && rsn != eSSU2TerminationReasonTerminationReceived)
 							RequestTermination (eSSU2TerminationReasonTerminationReceived);
@@ -1542,6 +1544,9 @@ namespace transport
 								m_State = eSSU2SessionStateClosingConfirmed;
 							Done ();
 						}
+					}
+					else
+						LogPrint(eLogWarning, "SSU2: Unexpected termination block size ", size);
 					break;
 				}
 				case eSSU2BlkRelayRequest: