Ensure scripthash is of the expected size before casting to a FullHash

src/rest.rs

@@ -879,7 +879,7 @@ fn to_scripthash(
 ) -> Result<FullHash, HttpError> {
     match script_type {
         "address" => address_to_scripthash(script_str, network),
-        "scripthash" => Ok(full_hash(&hex::decode(script_str)?)),
+        "scripthash" => parse_scripthash(script_str),
         _ => bail!("Invalid script type".to_string()),
     }
 }
@@ -898,6 +898,15 @@ fn address_to_scripthash(addr: &str, network: &Network) -> Result<FullHash, Http
     Ok(compute_script_hash(&addr.script_pubkey()))
 }
 
+fn parse_scripthash(scripthash: &str) -> Result<FullHash, HttpError> {
+    let bytes = hex::decode(scripthash)?;
+    if bytes.len() != 32 {
+        Err(HttpError::from("Invalid scripthash".to_string()))
+    } else {
+        Ok(full_hash(&bytes))
+    }
+}
+
 #[derive(Debug)]
 struct HttpError(StatusCode, String);