AVM: Catch any panic in edcsa verifying

[jannotti]

Return false from ecdsa_verify if library panics.

[codecov[bot]]

Codecov Report

Merging #4368 (d7c87d7) into master (00b37f2) will increase coverage by 0.01%. The diff coverage is 86.36%.

@@            Coverage Diff             @@
##           master    #4368      +/-   ##
==========================================
+ Coverage   55.28%   55.30%   +0.01%     
==========================================
  Files         398      398              
  Lines       50336    50340       +4     
==========================================
+ Hits        27829    27839      +10     
+ Misses      20178    20173       -5     
+ Partials     2329     2328       -1     

Impacted Files	Coverage Δ
data/transactions/logic/eval.go	89.45% <86.36%> (-0.10%)	:arrow_down:
agreement/cryptoVerifier.go	67.60% <0.00%> (-2.12%)	:arrow_down:
agreement/proposalManager.go	96.07% <0.00%> (-1.97%)	:arrow_down:
catchup/peerSelector.go	98.95% <0.00%> (-1.05%)	:arrow_down:
cmd/tealdbg/debugger.go	72.69% <0.00%> (-0.81%)	:arrow_down:
ledger/acctupdates.go	69.59% <0.00%> (-0.60%)	:arrow_down:
catchup/service.go	69.38% <0.00%> (ø)
network/wsNetwork.go	64.82% <0.00%> (+0.19%)	:arrow_up:
network/wsPeer.go	68.21% <0.00%> (+2.73%)	:arrow_up:
ledger/tracker.go	77.87% <0.00%> (+2.97%)	:arrow_up:
... and 1 more

:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more

[michaeldiamant]

For more complete context, here's the commit changing Go behavior: https://github.com/golang/go/commit/a218b3520a500254cc82b996b79ad6f5a355021c.

[cce]

Invalid points would have led to false before too, right?

[jannotti]

Invalid points would have led to false before too, right?

I sure hope so!

I am a little worried about this fix, because it assume nothing used to panic. If there was something that caused a panic before, that thing would now be caught and cause 0 instead of a guaranteed program failure.

I have done an alternate that explicitly tests for being on the curve instead. Maybe that's better?