ensure p2sh inputs have only push ops (do the same for raw multisig?).

lib/bcoin/tx.js

@@ -432,8 +432,17 @@ TX.prototype.verify = function verify(index, force) {
     assert(input.out.tx.outputs.length > input.out.index);
 
     var stack = [];
-    bcoin.script.execute(input.script, stack, this, i);
     var prev = input.out.tx.outputs[input.out.index].script;
+
+    if (bcoin.script.isScripthash(prev)) {
+      // p2sh transactions cannot have anything
+      // other than pushdata ops in the scriptSig
+      var push = !input.script.slice(1).every(Array.isArray);
+      if (push)
+        return false;
+    }
+
+    bcoin.script.execute(input.script, stack, this, i);
     var res = bcoin.script.execute(prev, stack, this, i);
     if (!res)
       return false;