extra fix

x/merkledb/path.go

@@ -36,14 +36,15 @@ func (s SerializedPath) deserialize() path {
 
 // HasPrefix returns true iff [prefix] is a prefix of [s] or equal to it.
 func (s SerializedPath) HasPrefix(prefix SerializedPath) bool {
-	if s.NibbleLength < prefix.NibbleLength {
+	prefixValue := prefix.Value
+	prefixLength := len(prefix.Value)
+	if s.NibbleLength < prefix.NibbleLength || len(s.Value) < prefixLength {
 		return false
 	}
-	prefixValue := prefix.Value
 	if !prefix.hasOddLength() {
 		return bytes.HasPrefix(s.Value, prefixValue)
 	}
-	reducedSize := len(prefixValue) - 1
+	reducedSize := prefixLength - 1
 
 	// the input was invalid so just return false
 	if reducedSize < 0 {

x/merkledb/path_test.go

@@ -70,6 +70,10 @@ func Test_SerializedPath_HasPrefix_BadInput(t *testing.T) {
 	a := SerializedPath{Value: []byte{}}
 	b := SerializedPath{Value: []byte{}, NibbleLength: 1}
 	require.False(t, a.HasPrefix(b))
+
+	a = SerializedPath{Value: []byte{}, NibbleLength: 10}
+	b = SerializedPath{Value: []byte{0x10}, NibbleLength: 1}
+	require.False(t, a.HasPrefix(b))
 }
 
 func Test_SerializedPath_Equal(t *testing.T) {