There was a off-by-one in buffer for the onion address.

The base32_onion function writes BASE32_ONIONLEN+1 bytes to the buffer, however the onion buffer only contains BASE32_ONIONLEN bytes.