verify_ecdsa reads sig[1] before it checks len(sig) < 4, so a 0- or 1-byte signature raises IndexError instead of returning False, which the comment promises for any DER encoding error.
Move the length check ahead of the byte access, and add a regression test.
verify_ecdsa reads sig[1] before it checks len(sig) < 4, so a 0- or
1-byte signature raises IndexError instead of returning False, which the
comment promises for any DER encoding error. Move the length check
first, and add a regression test.
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--006a51241073e994b41acfe9ec718e94-->
For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/36186.
<!--021abf342d371248e50ceaed478a90ca-->
See the guideline and AI policy for information on the review process. A summary of reviews will appear here.
<!--5faf32d7da4f0f540f40219e4f7537a3-->