This line in AcceptBlock can read past the end of scriptSig:
if (!std::equal(expect.begin(), expect.end(), block.vtx[0].vin[0].scriptSig.begin()))
A malicious block could potentially cause a node to access an invalid memory address, causing a crash.
More subtly, a malicious block that omits the final byte of the block height could have a 1 in 256 chance of being accepted as valid if the garbage byte past the end of the scriptSig happens to have the right value. By sending the same block to a node repeatedly, it may be possible to get the node to accept the invalid block with high probability.