A PSBT should be considered invalid if the size of <valuedata> doesn’t match the specified size in <valuesize>. However we don’t have any test case for it (and might be not well specified?). During differential fuzzing I noticed this is currently verified in Bitcoin Core (see below) but not checked in other implementations (e.g. btcd), causing a mismatch between them.
0// Takes a stream and multiple arguments and unserializes them first as a vector then each object individually in the order provided in the arguments
1template<typename Stream, typename... X>
2void UnserializeFromVector(Stream& s, X&&... args)
3{
4 size_t expected_size = ReadCompactSize(s);
5 size_t remaining_before = s.size();
6 UnserializeMany(s, args...);
7 size_t remaining_after = s.size();
8 if (remaining_after + expected_size != remaining_before) {
9 throw std::ios_base::failure("Size of value was not the stated size");
10 }
11}
