transaction: fix witness script length limits

See neo-project/neo#1958.

pkg/core/transaction/witness.go

@@ -6,6 +6,16 @@ import (
 	"github.com/nspcc-dev/neo-go/pkg/util"
 )
 
+const (
+	// MaxInvocationScript is the maximum length of allowed invocation
+	// script. It should fit 11/21 multisignature for the committee.
+	MaxInvocationScript = 1024
+
+	// MaxVerificationScript is the maximum allowed length of verification
+	// script. It should be appropriate for 11/21 multisignature committee.
+	MaxVerificationScript = 1024
+)
+
 // Witness contains 2 scripts.
 type Witness struct {
 	InvocationScript   []byte `json:"invocation"`
@@ -14,8 +24,8 @@ type Witness struct {
 
 // DecodeBinary implements Serializable interface.
 func (w *Witness) DecodeBinary(br *io.BinReader) {
-	w.InvocationScript = br.ReadVarBytes()
-	w.VerificationScript = br.ReadVarBytes()
+	w.InvocationScript = br.ReadVarBytes(MaxInvocationScript)
+	w.VerificationScript = br.ReadVarBytes(MaxVerificationScript)
 }
 
 // EncodeBinary implements Serializable interface.

pkg/core/transaction/witness_test.go

@@ -0,0 +1,38 @@
+package transaction
+
+import (
+	"testing"
+
+	"github.com/nspcc-dev/neo-go/pkg/internal/testserdes"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWitnessSerDes(t *testing.T) {
+	var good1 = &Witness{
+		InvocationScript:   make([]byte, 64),
+		VerificationScript: make([]byte, 32),
+	}
+	var good2 = &Witness{
+		InvocationScript:   make([]byte, MaxInvocationScript),
+		VerificationScript: make([]byte, MaxVerificationScript),
+	}
+	var bad1 = &Witness{
+		InvocationScript:   make([]byte, MaxInvocationScript+1),
+		VerificationScript: make([]byte, 32),
+	}
+	var bad2 = &Witness{
+		InvocationScript:   make([]byte, 128),
+		VerificationScript: make([]byte, MaxVerificationScript+1),
+	}
+	var exp = new(Witness)
+	testserdes.MarshalUnmarshalJSON(t, good1, exp)
+	testserdes.MarshalUnmarshalJSON(t, good2, exp)
+	testserdes.EncodeDecodeBinary(t, good1, exp)
+	testserdes.EncodeDecodeBinary(t, good2, exp)
+	bin1, err := testserdes.EncodeBinary(bad1)
+	require.NoError(t, err)
+	bin2, err := testserdes.EncodeBinary(bad2)
+	require.NoError(t, err)
+	require.Error(t, testserdes.DecodeBinary(bin1, exp))
+	require.Error(t, testserdes.DecodeBinary(bin2, exp))
+}