Skip to content

hardening: return Err instead of panic in ssz_decode_fixed_vec#21

Open
MegaRedHand wants to merge 1 commit into
mainfrom
hardening/decode-fixed-vec-no-panic
Open

hardening: return Err instead of panic in ssz_decode_fixed_vec#21
MegaRedHand wants to merge 1 commit into
mainfrom
hardening/decode-fixed-vec-no-panic

Conversation

@MegaRedHand

Copy link
Copy Markdown
Contributor

Summary

  • Both the trait default (SszDecode::ssz_decode_fixed_vec) and the derive-generated override called chunks_exact(0) when invoked on a variable-size type, causing an unconditional panic (division by zero in chunks_exact).
  • This PR adds a new DecodeError::NotFixedSize variant and uses it to return Err instead of panicking in both code paths.
  • All internal call sites already guard with is_fixed_size() before calling ssz_decode_fixed_vec, so this change is purely defensive. It protects against direct external misuse of the API.

Changes

File Change
crates/ssz/src/error.rs Add NotFixedSize variant to DecodeError
crates/ssz/src/decode.rs Guard trait default with item_size == 0 check
crates/ssz-derive/src/lib.rs Replace dead-code chunks_exact fallback with Err(NotFixedSize)

Test plan

  • cargo build --workspace --all-targets --exclude spec-tests
  • cargo clippy --workspace --all-targets --exclude spec-tests -- -D warnings
  • cargo test --workspace --exclude spec-tests
  • cargo test --workspace --exclude spec-tests --no-default-features --features alloc
  • cargo check -p libssz -p libssz-types -p libssz-merkle --target thumbv7m-none-eabi --no-default-features --features alloc

.chunks_exact(item_size)
.map(Self::from_ssz_bytes)
.collect()
Err(libssz::DecodeError::NotFixedSize)

@MegaRedHand MegaRedHand Mar 31, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the equivalent of ssz_decode_fixed_vec but in the derive macro

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants