From f4fba6fbeebf22b69254496cf8b5393ce14f3860 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Tue, 31 Mar 2026 14:37:59 -0300
Subject: [PATCH] hardening: return Err instead of panic in
 ssz_decode_fixed_vec

---
 crates/ssz-derive/src/lib.rs | 7 +------
 crates/ssz/src/decode.rs     | 3 +++
 crates/ssz/src/error.rs      | 2 ++
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/crates/ssz-derive/src/lib.rs b/crates/ssz-derive/src/lib.rs
index b4d873a..c8a1dbd 100644
--- a/crates/ssz-derive/src/lib.rs
+++ b/crates/ssz-derive/src/lib.rs
@@ -582,12 +582,7 @@ fn derive_decode_struct(
                     }
                     Ok(result)
                 } else {
-                    // Variable-size: fall back to default
-                    let item_size = <Self as libssz::SszDecode>::fixed_size();
-                    bytes
-                        .chunks_exact(item_size)
-                        .map(Self::from_ssz_bytes)
-                        .collect()
+                    Err(libssz::DecodeError::NotFixedSize)
                 }
             }
         }
diff --git a/crates/ssz/src/decode.rs b/crates/ssz/src/decode.rs
index 6986f4d..698f517 100644
--- a/crates/ssz/src/decode.rs
+++ b/crates/ssz/src/decode.rs
@@ -22,6 +22,9 @@ pub trait SszDecode: Sized {
     #[cfg(feature = "alloc")]
     fn ssz_decode_fixed_vec(bytes: &[u8]) -> Result<Vec<Self>, DecodeError> {
         let item_size = Self::fixed_size();
+        if item_size == 0 {
+            return Err(DecodeError::NotFixedSize);
+        }
         bytes
             .chunks_exact(item_size)
             .map(Self::from_ssz_bytes)
diff --git a/crates/ssz/src/error.rs b/crates/ssz/src/error.rs
index 1482848..9c9420f 100644
--- a/crates/ssz/src/error.rs
+++ b/crates/ssz/src/error.rs
@@ -24,6 +24,8 @@ pub enum DecodeError {
     MissingDelimiterBit,
     /// A container has zero variable-length fields but leftover bytes.
     AdditionalBytes { expected: usize, got: usize },
+    /// `ssz_decode_fixed_vec` was called on a variable-size type.
+    NotFixedSize,
 }
 
 #[cfg(feature = "std")]