tariscript OP_COMPARE_VERIFY can crash with overflow

[SWvheerden]

An attacker can craft a transaction with a malicious script that crashes any node
which attempts to execute it.
The crash is triggered by an underflow in the OP_COMPARE_VERIFY opcode:

fn handle_compare_height(stack: &mut ExecutionStack, block_height:
u64) -> Result<(), ScriptError> {
let target_height = stack.pop_into_number::<i64>()?;
let block_height = i64::try_from(block_height)?;
let item = StackItem::Number(block_height - target_height);
stack.push(item)
}

An attacker creates a script which puts into the stack the i64::MIN. Any
subtraction will then cause the underflow.
let script = TariScript::new(vec![PushInt(i64::MIN), CompareHeight]);

[brianp]

Just a note about the description of this task. The op codes in question are actually CompareHeight and CheckHeight.

CompareHeightVerify, and CheckHeightVerify are fine.