From f9580983e79c6c9999b13685d1c4ed359241002f Mon Sep 17 00:00:00 2001
From: Matus Kysel <matuskysel1@gmail.com>
Date: Fri, 26 Sep 2025 12:24:39 +0200
Subject: [PATCH] ethapi: reject oversize storage keys before hex decode

---
 internal/ethapi/api.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/internal/ethapi/api.go b/internal/ethapi/api.go
index ebb8ece730..d648feaf96 100644
--- a/internal/ethapi/api.go
+++ b/internal/ethapi/api.go
@@ -446,6 +446,9 @@ func decodeHash(s string) (h common.Hash, inputLength int, err error) {
 	if strings.HasPrefix(s, "0x") || strings.HasPrefix(s, "0X") {
 		s = s[2:]
 	}
+	if len(s) > 64 { // 32 bytes
+		return common.Hash{}, len(s) / 2, errors.New("hex string too long, want at most 32 bytes")
+	}
 	if (len(s) & 1) > 0 {
 		s = "0" + s
 	}
@@ -453,9 +456,6 @@ func decodeHash(s string) (h common.Hash, inputLength int, err error) {
 	if err != nil {
 		return common.Hash{}, 0, errors.New("hex string invalid")
 	}
-	if len(b) > 32 {
-		return common.Hash{}, len(b), errors.New("hex string too long, want at most 32 bytes")
-	}
 	return common.BytesToHash(b), len(b), nil
 }