From 29576c7bcc19c1939a5f72056629515df44dd6dc Mon Sep 17 00:00:00 2001
From: Christopher Jeffrey <chjjeffrey@gmail.com>
Date: Thu, 18 Feb 2016 22:53:13 -0800
Subject: [PATCH] fix checkmultisig for nonstandard scripts.

---
 lib/bcoin/script.js | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/lib/bcoin/script.js b/lib/bcoin/script.js
index 0830a20e..7357a5c9 100644
--- a/lib/bcoin/script.js
+++ b/lib/bcoin/script.js
@@ -918,7 +918,7 @@ script.execute = function execute(data, stack, tx, index, flags, recurse) {
       }
       case 'checkmultisigverify':
       case 'checkmultisig': {
-        if (!tx || stack.length < 3)
+        if (!tx || stack.length < 4)
           return false;
 
         n = script.num(stack.pop(), true);
@@ -944,7 +944,7 @@ script.execute = function execute(data, stack, tx, index, flags, recurse) {
         if (!(m >= 1 && m <= n))
           return false;
 
-        if (stack.length < m + 1)
+        if (stack.length < m)
           return false;
 
         subscript = script.getSubscript(data, lastSep);
@@ -973,12 +973,12 @@ script.execute = function execute(data, stack, tx, index, flags, recurse) {
             succ++;
         }
 
-        if (stack.length < 1)
-          return false;
-
-        val = stack.pop();
-
         if (flags & constants.flags.VERIFY_NULLDUMMY) {
+          if (stack.length < 1)
+            return false;
+
+          val = stack.pop();
+
           if (!script.isDummy(val))
             return false;
         }
@@ -1009,8 +1009,10 @@ script.execute = function execute(data, stack, tx, index, flags, recurse) {
         if (!Array.isArray(locktime))
           return false;
 
-        if (locktime.length > 6)
+        if (locktime.length > 6) {
+          utils.debug('Warning: locktime is over 53 bits.');
           return false;
+        }
 
         locktime = script.num(locktime, true);
 
@@ -1028,7 +1030,7 @@ script.execute = function execute(data, stack, tx, index, flags, recurse) {
         if (locktime > tx.locktime)
           return false;
 
-        if (!tx.inputs[index] || tx.inputs[index].sequence === 0xffffffff)
+        if (tx.inputs[index].sequence === 0xffffffff)
           return false;
 
         break;