script: return malformed script if returned pushDataOut out of range

src/script.js

@@ -41,8 +41,11 @@ Script.fromBuffer = function (buffer) {
 
       // did reading a pushDataInt fail? return non-chunked script
       if (d === null) return new Script(buffer, [])
-
       i += d.size
+
+      // attempt to read too much data?
+      if (i + d.number > buffer.length) return new Script(buffer, [])
+
       var data = buffer.slice(i, i + d.number)
       i += d.number