From b98bd6276375a3cffed4dbb8d65ccbd3a2d8df7b Mon Sep 17 00:00:00 2001
From: Nadav Ivgi <nadav@shesek.info>
Date: Sun, 17 Feb 2019 11:57:34 +0200
Subject: [PATCH] Ensure scripthash is of the expected size before casting to a
 FullHash

---
 src/rest.rs | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/rest.rs b/src/rest.rs
index adeb6098..7f53f453 100644
--- a/src/rest.rs
+++ b/src/rest.rs
@@ -879,7 +879,7 @@ fn to_scripthash(
 ) -> Result<FullHash, HttpError> {
     match script_type {
         "address" => address_to_scripthash(script_str, network),
-        "scripthash" => Ok(full_hash(&hex::decode(script_str)?)),
+        "scripthash" => parse_scripthash(script_str),
         _ => bail!("Invalid script type".to_string()),
     }
 }
@@ -898,6 +898,15 @@ fn address_to_scripthash(addr: &str, network: &Network) -> Result<FullHash, Http
     Ok(compute_script_hash(&addr.script_pubkey()))
 }
 
+fn parse_scripthash(scripthash: &str) -> Result<FullHash, HttpError> {
+    let bytes = hex::decode(scripthash)?;
+    if bytes.len() != 32 {
+        Err(HttpError::from("Invalid scripthash".to_string()))
+    } else {
+        Ok(full_hash(&bytes))
+    }
+}
+
 #[derive(Debug)]
 struct HttpError(StatusCode, String);