psbt: Check Taproot tree depth and leaf versions

Since TaprootBuilder has assertions for the depth and leaf versions, the
PSBT decoder should check these values before calling
TaprootBuilder::Add so that the assertions are not triggered on
malformed taproot trees.

1 files changed, 6 insertions, 0 deletions

diff --git a/src/psbt.h b/src/psbt.h
index a143a99988..c390bb67d3 100644
--- a/src/psbt.h
+++ b/src/psbt.h
@@ -866,6 +866,12 @@ struct PSBTOutput
                         s_tree >> depth;
                         s_tree >> leaf_ver;
                         s_tree >> script;
+                        if (depth > TAPROOT_CONTROL_MAX_NODE_COUNT) {
+                            throw std::ios_base::failure("Output Taproot tree has as leaf greater than Taproot maximum depth");
+                        }
+                        if ((leaf_ver & ~TAPROOT_LEAF_MASK) != 0) {
+                            throw std::ios_base::failure("Output Taproot tree has a leaf with an invalid leaf version");
+                        }
                         m_tap_tree->Add((int)depth, script, (int)leaf_ver, true /* track */);
                     }
                     if (!m_tap_tree->IsComplete()) {