ralexstokes / ssz-rs

Implementation of ethereum's `ssz`
Apache License 2.0
103 stars 41 forks source link

add potential fix for OOR access on Vector #54

Closed 0xTylerHolmes closed 1 year ago

0xTylerHolmes commented 1 year ago

Unlike the issue this does not use the safe vec::get method, but does emit an already defined DeserializeError. I am open to other options for the easiest way to fix this. If this is a desired approach I can add some other guards where they are needed.

0xTylerHolmes commented 1 year ago

Note this is in reference to #22

0xTylerHolmes commented 1 year ago

In reference to #22 I changed it to instead use the .get() method on encoding. To my knowledge there isn't a good way to get the exact reason of the failure so I just added a generic DeserializeError::InvalidRange{range: Range, buffer_length: usize},