Note possible checked_sub cases

ssz-rs-derive/src/lib.rs

@@ -192,8 +192,9 @@ fn derive_deserialize_impl(data: &Data) -> TokenStream {
                     Some(field_name) => quote_spanned! { f.span() =>
                         let bytes_read = if <#field_type>::is_variable_size() {
                             let end = start + #BYTES_PER_LENGTH_OFFSET;
-                            let next_offset = u32::deserialize(&encoding[start..end])?;
-                            offsets.push((#i, next_offset as usize));
+                            let next_offset = u32::deserialize(&encoding[start..end])? as usize;
+                            offsets.last().map(|(_, previous_offset)| assert!(next_offset >= *previous_offset));
+                            offsets.push((#i, next_offset));
 
                             #BYTES_PER_LENGTH_OFFSET
                         } else {
@@ -228,6 +229,7 @@ fn derive_deserialize_impl(data: &Data) -> TokenStream {
                         let (_, end) = span[1];
 
                         container.__ssz_rs_set_by_index(index, &encoding[start..end])?;
+                        // checked_sub is unnecessary, as offsets are increasing
                         total_bytes_read += end - start;
                     }
 

ssz-rs/src/bitlist.rs

@@ -51,6 +51,7 @@ impl<const N: usize> fmt::Debug for Bitlist<N> {
             let value = i32::from(*bit);
             write!(f, "{value}")?;
             bits_written += 1;
+            // checked_sub is unnecessary, as len >= 1 when this for loop runs
             if bits_written % 4 == 0 && index != len - 1 {
                 write!(f, "_")?;
             }
@@ -110,6 +111,7 @@ impl<const N: usize> Bitlist<N> {
                 *last |= 1u8 << marker_index;
             }
         }
+        // checked_sub is unnecessary, as buffer.len() > start_len
         Ok(buffer.len() - start_len)
     }
 }
@@ -159,14 +161,22 @@ impl<const N: usize> Deserialize for Bitlist<N> {
         }
 
         let (last_byte, prefix) = encoding.split_last().unwrap();
+        if *last_byte == 0u8 {
+            return Err(DeserializeError::InvalidByte(*last_byte));
+        }
+
         let mut result = BitlistInner::from_slice(prefix);
         let last = BitlistInner::from_element(*last_byte);
+        // checked_sub is unnecessary, as last_byte != 0, so last.trailing_zeros <= 7
+        // high_bit_index >= 1
         let high_bit_index = 8 - last.trailing_zeros();
 
+        // checked_sub is unnecessary, as high_bit_index >= 1
         if !last[high_bit_index - 1] {
             return Err(DeserializeError::InvalidByte(*last_byte))
         }
 
+        // checked_sub is unnecessary, as high_bit_index >= 1
         for bit in last.iter().take(high_bit_index - 1) {
             result.push(*bit);
         }

ssz-rs/src/bitvector.rs

@@ -60,6 +60,7 @@ impl<const N: usize> fmt::Debug for Bitvector<N> {
             let value = i32::from(*bit);
             write!(f, "{value}")?;
             bits_written += 1;
+            // checked_sub is unnecessary, as len >= 1 for bitvectors
             if bits_written % 4 == 0 && index != len - 1 {
                 write!(f, "_")?;
             }

ssz-rs/src/de.rs

@@ -71,6 +71,7 @@ where
     if remainder != 0 {
         return Err(DeserializeError::AdditionalInput {
             provided: encoding.len(),
+            // checked_sub is unnecessary, as encoding.len() > remainder
             expected: encoding.len() - remainder,
         })
     }

ssz-rs/src/merkleization/mod.rs

@@ -46,9 +46,10 @@ impl Display for MerkleizationError {
 impl std::error::Error for MerkleizationError {}
 
 pub fn pack_bytes(buffer: &mut Vec<u8>) {
-    let data_len = buffer.len();
-    if data_len % BYTES_PER_CHUNK != 0 {
-        let bytes_to_pad = BYTES_PER_CHUNK - data_len % BYTES_PER_CHUNK;
+    let incomplete_chunk_len = buffer.len() % BYTES_PER_CHUNK;
+    if incomplete_chunk_len != 0 {
+        // checked_sub is unnecessary, as BYTES_PER_CHUNK > incomplete_chunk_len
+        let bytes_to_pad = BYTES_PER_CHUNK - incomplete_chunk_len;
         let pad = vec![0u8; bytes_to_pad];
         buffer.extend_from_slice(&pad);
     }
@@ -116,11 +117,13 @@ fn merkleize_chunks_with_virtual_padding(
     let height = leaf_count.trailing_zeros() + 1;
 
     if chunk_count == 0 {
+        // checked_sub is unnecessary, as height >= 1
         let depth = height - 1;
         return Ok(CONTEXT[depth as usize].try_into().expect("can produce a single root chunk"))
     }
 
     let mut layer = chunks.to_vec();
+    // checked_sub is unnecessary, as we return early when chunk_count == 0
     let mut last_index = chunk_count - 1;
     for k in (1..height).rev() {
         for i in (0..2usize.pow(k)).step_by(2) {
@@ -129,10 +132,17 @@ fn merkleize_chunks_with_virtual_padding(
                 Ordering::Less => {
                     let focus =
                         &mut layer[parent_index * BYTES_PER_CHUNK..(i + 2) * BYTES_PER_CHUNK];
+                    // checked_sub is unnecessary:
+                    // i >= parent_index
+                    // and
+                    // focus.len() = (i + 2 - parent_index) * BYTES_PER_CHUNK
+                    // so focus.len() >= 2 * BYTES_PER_CHUNK
                     let children_index = focus.len() - 2 * BYTES_PER_CHUNK;
                     let (parent, children) = focus.split_at_mut(children_index);
                     let (left, right) = children.split_at_mut(BYTES_PER_CHUNK);
                     if parent.is_empty() {
+                        // TODO: Why not i == 0? Is there another case where the left node is used
+                        // to store the parent?
                         // NOTE: have to specially handle the situation where the children nodes and
                         // parent node share memory
                         hasher.update(&left);
@@ -145,9 +155,15 @@ fn merkleize_chunks_with_virtual_padding(
                 Ordering::Equal => {
                     let focus =
                         &mut layer[parent_index * BYTES_PER_CHUNK..(i + 1) * BYTES_PER_CHUNK];
+                    // checked_sub is unnecessary:
+                    // i >= parent_index
+                    // and
+                    // focus.len() = (i + 1 - parent_index) * BYTES_PER_CHUNK
+                    // so focus.len() >= BYTES_PER_CHUNK
                     let children_index = focus.len() - BYTES_PER_CHUNK;
-                    let (parent, children) = focus.split_at_mut(children_index);
-                    let (left, _) = children.split_at_mut(BYTES_PER_CHUNK);
+                    let (parent, left) = focus.split_at_mut(children_index);
+                    // checked_sub is unnecessary, as k <= height - 1
+                    // so depth >= height - (height - 1) - 1 = 0
                     let depth = height - k - 1;
                     let right = &CONTEXT[depth as usize];
                     if parent.is_empty() {
@@ -265,27 +281,36 @@ mod tests {
         debug_assert!(chunks.len() % BYTES_PER_CHUNK == 0);
         debug_assert!(leaf_count.next_power_of_two() == leaf_count);
 
+        // checked_sub is unnecessary, as leaf_count != 0 (0.next_power_of_two() == 1)
         let node_count = 2 * leaf_count - 1;
+        // checked_sub is unnecessary, as node_count >= leaf_count
         let interior_count = node_count - leaf_count;
         let leaf_start = interior_count * BYTES_PER_CHUNK;
 
         let mut hasher = Sha256::new();
         let mut buffer = vec![0u8; node_count * BYTES_PER_CHUNK];
         buffer[leaf_start..leaf_start + chunks.len()].copy_from_slice(chunks);
-        let zero_chunk = [0u8; 32];
+        let zero_chunk = [0u8; BYTES_PER_CHUNK];
         for i in chunks.len()..leaf_count {
             let start = leaf_start + (i * BYTES_PER_CHUNK);
             let end = leaf_start + (i + 1) * BYTES_PER_CHUNK;
             buffer[start..end].copy_from_slice(&zero_chunk);
         }
 
         for i in (1..node_count).rev().step_by(2) {
+            // checked_sub is unnecessary, as i >= 1
             let parent_index = (i - 1) / 2;
             let focus = &mut buffer[parent_index * BYTES_PER_CHUNK..(i + 1) * BYTES_PER_CHUNK];
+            // TODO: checked_sub
+            // focus.len() = (i + 1 - parent_index) * BYTES_PER_CHUNK
+            //             = ((2*i + 2 - i + 1) / 2) * BYTES_PER_CHUNK
+            //             = ((i + 3) / 2) * BYTES_PER_CHUNK
+            // and
+            // i >= 1
+            // so focus.len() >= 2 * BYTES_PER_CHUNK
             let children_index = focus.len() - 2 * BYTES_PER_CHUNK;
             let (parent, children) = focus.split_at_mut(children_index);
-            let left = &children[0..BYTES_PER_CHUNK];
-            let right = &children[BYTES_PER_CHUNK..2 * BYTES_PER_CHUNK];
+            let (left, right) = children.split_at(BYTES_PER_CHUNK);
             hash_nodes(&mut hasher, left, right, &mut parent[..BYTES_PER_CHUNK]);
         }
         Ok(buffer[0..BYTES_PER_CHUNK].try_into().expect("can produce a single root chunk"))