psbt: Fix PSBTInputSignedAndVerified bounds assert

l0rinc · willcl-ark · commit 4e3a175b8558 · 2026-01-13T15:12:22.000Z
The previous `assert` used `>=`, allowing `input_index == psbt.inputs.size()` and out-of-bounds access in `psbt.inputs[input_index]`. Found during review: bitcoin#31650 (comment)
diff --git a/src/psbt.cpp b/src/psbt.cpp
@@ -325,7 +325,7 @@ bool PSBTInputSigned(const PSBTInput& input)
 bool PSBTInputSignedAndVerified(const PartiallySignedTransaction psbt, unsigned int input_index, const PrecomputedTransactionData* txdata)
 {
     CTxOut utxo;
-    assert(psbt.inputs.size() >= input_index);
+    assert(input_index < psbt.inputs.size());
     const PSBTInput& input = psbt.inputs[input_index];
 
     if (input.non_witness_utxo) {

Original file line number	Diff line number	Diff line change
`@@ -325,7 +325,7 @@ bool PSBTInputSigned(const PSBTInput& input)`
`325`	`325`	`bool PSBTInputSignedAndVerified(const PartiallySignedTransaction psbt, unsigned int input_index, const PrecomputedTransactionData* txdata)`
`326`	`326`	`{`
`327`	`327`	`CTxOut utxo;`
`328`		`- assert(psbt.inputs.size() >= input_index);`
	`328`	`+ assert(input_index < psbt.inputs.size());`
`329`	`329`	`const PSBTInput& input = psbt.inputs[input_index];`
`330`	`330`
`331`	`331`	`if (input.non_witness_utxo) {`