coinstatsindex: guard input index against inconsistent undo data #36062

CustomAppend and RevertBlock walk each transaction's spent inputs using the block undo data read from disk, bounding the loop by tx_undo.vprevout.size() while indexing the transaction's own inputs with tx->vin[j]. If an undo record holds more prevouts than the transaction has inputs, that reads past the end of vin; DisconnectBlock already rejects the same vprevout/vin mismatch before restoring inputs, but the two coinstatsindex callbacks skip that check. This adds the matching size check to both so they fail the index cleanly instead of reading out of bounds.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/36062.

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process.

If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

In what scenario is this actually fixing a bug?

Approach NACK Hardening against inconsistent undo data is fine if there is a demonstrated gap. Without one, checks in these two callbacks seem arbitrary: other undo-data consumers rely on the same size relationships, and each would need a concrete failure mode and proof that validation belongs there.

It's not a bug reachable through normal operation. The loop trusts vprevout.size() from the on-disk undo record while indexing tx->vin, so a record holding more prevouts than the tx has inputs would read past vin. That only happens with corrupted or tampered rev*.dat (checksum-valid but internally inconsistent), which is the same threat model DisconnectBlock guards at its one spot.

Fair point though: if that invariant is assumed to hold, singling out these two consumers is arbitrary and I don't have a demonstrated gap to justify it. I'll close this.