From d4d8fc25758b04802f19ba3b84321c2bfe738f7f Mon Sep 17 00:00:00 2001
From: pk910 <philipp@pk910.de>
Date: Sat, 13 Apr 2024 01:19:51 +0200
Subject: [PATCH] check offset in dynamic slice unmarshaling

---
 unmarshal.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/unmarshal.go b/unmarshal.go
index 761e883..b492cdc 100644
--- a/unmarshal.go
+++ b/unmarshal.go
@@ -456,6 +456,7 @@ func (d *DynSsz) unmarshalDynamicSlice(targetType reflect.Type, targetValue refl
 	targetValue.Set(newValue)
 
 	offset := int(firstOffset)
+	sszLen := len(ssz)
 	if sliceLen > 0 {
 		// decode slice items
 		for i := 0; i < sliceLen; i++ {
@@ -471,11 +472,14 @@ func (d *DynSsz) unmarshalDynamicSlice(targetType reflect.Type, targetValue refl
 			startOffset := sliceOffsets[i]
 			endOffset := 0
 			if i == sliceLen-1 {
-				endOffset = len(ssz)
+				endOffset = sszLen
 			} else {
 				endOffset = sliceOffsets[i+1]
 			}
 			itemSize := endOffset - startOffset
+			if itemSize < 0 || endOffset > sszLen {
+				return 0, ErrOffset
+			}
 
 			itemSsz := ssz[startOffset:endOffset]