enc is at least one byte

lib/picotls.c

@@ -1022,6 +1022,10 @@ static int decode_one_ech_config(ptls_hpke_kem_t **kems, ptls_hpke_cipher_suite_
         }
     }
     ptls_decode_open_block(*src, end, 2, {
+        if (*src == end) {
+            ret = PTLS_ALERT_DECODE_ERROR;
+            goto Exit;
+        }
         decoded->public_key = ptls_iovec_init(*src, end - *src);
         *src = end;
     });