Add a bounds check before accessing a user-provided PK string

TheBlueMatt · TheBlueMatt · commit 147435bfe69b · 2022-03-26T20:33:47.000Z
Fixes lightningdevkit#53.
diff --git a/src/hex_utils.rs b/src/hex_utils.rs
@@ -31,6 +31,9 @@ pub fn hex_str(value: &[u8]) -> String {
 }
 
 pub fn to_compressed_pubkey(hex: &str) -> Option<PublicKey> {
+	if hex.len() != 33 * 2 {
+		return None;
+	}
 	let data = match to_vec(&hex[0..33 * 2]) {
 		Some(bytes) => bytes,
 		None => return None,

Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,9 @@ pub fn hex_str(value: &[u8]) -> String {`
`31`	`31`	`}`
`32`	`32`
`33`	`33`	`pub fn to_compressed_pubkey(hex: &str) -> Option<PublicKey> {`
	`34`	`+ if hex.len() != 33 * 2 {`
	`35`	`+ return None;`
	`36`	`+ }`
`34`	`37`	`let data = match to_vec(&hex[0..33 * 2]) {`
`35`	`38`	`Some(bytes) => bytes,`
`36`	`39`	`None => return None,`