A PSBT should be considered invalid if the size of <valuedata> doesn't match the specified size in <valuesize>. However we don't have any test case for it (and might be not well specified?). During differential fuzzing I noticed this is currently verified in Bitcoin Core (see below) but not checked in other implementations (e.g. btcd), causing a mismatch between them.
// Takes a stream and multiple arguments and unserializes them first as a vector then each object individually in the order provided in the arguments
template<typename Stream, typename... X>
void UnserializeFromVector(Stream& s, X&&... args)
{
size_t expected_size = ReadCompactSize(s);
size_t remaining_before = s.size();
UnserializeMany(s, args...);
size_t remaining_after = s.size();
if (remaining_after + expected_size != remaining_before) {
throw std::ios_base::failure("Size of value was not the stated size");
}
}
