The generic reader didn't have a buffer that was large enough to

save uncomplete messages. I had forgotten about the four bytes of
message length preceding the message. A buffer overflow could occur
because of this. Ouch!

btpd/net.c

@@ -766,6 +766,7 @@ net_generic_read(struct peer *p, unsigned long rmax)
     }
     if (off != len) {
 	gr->iob.buf_off = len - off;
+        assert(gr->iob.buf_off <= gr->iob.buf_len);
 	bcopy(buf + off, gr->iob.buf, gr->iob.buf_off);
     }
     event_add(&p->in_ev, NULL);

btpd/net.h

@@ -65,7 +65,7 @@ struct handshake {
     char _io_buf[SHAKE_LEN];
 };
 
-#define MAX_INPUT_LEFT 12
+#define MAX_INPUT_LEFT 16
 
 struct generic_reader {
     struct input_reader rd;