check offset in dynamic slice unmarshaling

pk910 · Apr 12, 2024 · d4d8fc2 · d4d8fc2
1 parent 5ba3559
commit d4d8fc2
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/unmarshal.go b/unmarshal.go
@@ -456,6 +456,7 @@ func (d *DynSsz) unmarshalDynamicSlice(targetType reflect.Type, targetValue refl
 	targetValue.Set(newValue)
 
 	offset := int(firstOffset)
+	sszLen := len(ssz)
 	if sliceLen > 0 {
 		// decode slice items
 		for i := 0; i < sliceLen; i++ {
@@ -471,11 +472,14 @@ func (d *DynSsz) unmarshalDynamicSlice(targetType reflect.Type, targetValue refl
 			startOffset := sliceOffsets[i]
 			endOffset := 0
 			if i == sliceLen-1 {
-				endOffset = len(ssz)
+				endOffset = sszLen
 			} else {
 				endOffset = sliceOffsets[i+1]
 			}
 			itemSize := endOffset - startOffset
+			if itemSize < 0 || endOffset > sszLen {
+				return 0, ErrOffset
+			}
 
 			itemSsz := ssz[startOffset:endOffset]