From 6b24bb7c7f43b0029527a3e7bc36e5936c9aa8ef Mon Sep 17 00:00:00 2001
From: Florent de Lamotte <florent@frizoncorrea.fr>
Date: Tue, 18 Nov 2025 11:27:48 +0100
Subject: [PATCH] check key size in _validate_destination

---
 src/meshcore/commands/base.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/meshcore/commands/base.py b/src/meshcore/commands/base.py
index ae2776a..7fc378f 100644
--- a/src/meshcore/commands/base.py
+++ b/src/meshcore/commands/base.py
@@ -32,10 +32,14 @@ def _validate_destination(dst: DestinationType, prefix_length: int = 6) -> bytes
     """
     if isinstance(dst, bytes):
         # Already bytes, use directly
+        if len(dst)<prefix_length:
+            raise ValueError(f"Invalid prefix len, expecting {prefix_length}, got {len(dst)}")
         return dst[:prefix_length]
     elif isinstance(dst, str):
         # Hex string, convert to bytes
         try:
+            if len(dst)<2*prefix_length:
+                raise ValueError(f"Invalid prefix len, expecting {prefix_length}, got {len(dst)/2}")
             return bytes.fromhex(dst)[:prefix_length]
         except ValueError:
             raise ValueError(f"Invalid public key hex string: {dst}")