bufferutils/script: allow for invalid pushDatInts, fixes #367

src/bufferutils.js

@@ -27,16 +27,19 @@ function readPushDataInt (buffer, offset) {
 
   // 8 bit
   } else if (opcode === opcodes.OP_PUSHDATA1) {
+    if (offset + 2 > buffer.length) return null
     number = buffer.readUInt8(offset + 1)
     size = 2
 
   // 16 bit
   } else if (opcode === opcodes.OP_PUSHDATA2) {
+    if (offset + 3 > buffer.length) return null
     number = buffer.readUInt16LE(offset + 1)
     size = 3
 
   // 32 bit
   } else {
+    if (offset + 5 > buffer.length) return null
     assert.equal(opcode, opcodes.OP_PUSHDATA4, 'Unexpected opcode')
 
     number = buffer.readUInt32LE(offset + 1)