bitcoin-spv - Bitcoin output script length is not checked in wpkhSpendSighash  Won't Fix
`CheckBitcoinSigs.wpkhSpendSighash` calculates the sighash of a Bitcoin transaction. Among its parameters, it accepts `bytes memory _outpoint`, which is a 36-byte UTXO id consisting of a 32-byte transaction hash and a 4-byte output index.\\nThe function in question should not accept an `_outpoint` that is not 36-bytes, but no length check is made:\\n```\\nfunction wpkhSpendSighash(\\n    bytes memory \\_outpoint,  // 36 byte UTXO id\\n    bytes20 \\_inputPKH,       // 20 byte hash160\\n    bytes8 \\_inputValue,      // 8-byte LE\\n    bytes8 \\_outputValue,     // 8-byte LE\\n    bytes memory \\_outputScript    // lenght-prefixed output script\\n) internal pure returns (bytes32) {\\n    // Fixes elements to easily make a 1-in 1-out sighash digest\\n    // Does not support timelocks\\n    bytes memory \\_scriptCode = abi.encodePacked(\\n        hex"1976a914",  // length, dup, hash160, pkh\\_length\\n        \\_inputPKH,\\n        hex"88ac");  // equal, checksig\\n    bytes32 \\_hashOutputs = abi.encodePacked(\\n        \\_outputValue,  // 8-byte LE\\n        \\_outputScript).hash256();\\n    bytes memory \\_sighashPreimage = abi.encodePacked(\\n        hex"01000000",  // version\\n        \\_outpoint.hash256(),  // hashPrevouts\\n        hex"8cb9012517c817fead650287d61bdd9c68803b6bf9c64133dcab3e65b5a50cb9",  // hashSequence(00000000)\\n        \\_outpoint,  // outpoint\\n        \\_scriptCode,  // p2wpkh script code\\n        \\_inputValue,  // value of the input in 8-byte LE\\n        hex"00000000",  // input nSequence\\n        \\_hashOutputs,  // hash of the single output\\n        hex"00000000",  // nLockTime\\n        hex"01000000"  // SIGHASH\\_ALL\\n    );\\n    return \\_sighashPreimage.hash256();\\n}\\n```\\n
Check that `_outpoint.length` is 36.
```\\nfunction wpkhSpendSighash(\\n    bytes memory \\_outpoint,  // 36 byte UTXO id\\n    bytes20 \\_inputPKH,       // 20 byte hash160\\n    bytes8 \\_inputValue,      // 8-byte LE\\n    bytes8 \\_outputValue,     // 8-byte LE\\n    bytes memory \\_outputScript    // lenght-prefixed output script\\n) internal pure returns (bytes32) {\\n    // Fixes elements to easily make a 1-in 1-out sighash digest\\n    // Does not support timelocks\\n    bytes memory \\_scriptCode = abi.encodePacked(\\n        hex"1976a914",  // length, dup, hash160, pkh\\_length\\n        \\_inputPKH,\\n        hex"88ac");  // equal, checksig\\n    bytes32 \\_hashOutputs = abi.encodePacked(\\n        \\_outputValue,  // 8-byte LE\\n        \\_outputScript).hash256();\\n    bytes memory \\_sighashPreimage = abi.encodePacked(\\n        hex"01000000",  // version\\n        \\_outpoint.hash256(),  // hashPrevouts\\n        hex"8cb9012517c817fead650287d61bdd9c68803b6bf9c64133dcab3e65b5a50cb9",  // hashSequence(00000000)\\n        \\_outpoint,  // outpoint\\n        \\_scriptCode,  // p2wpkh script code\\n        \\_inputValue,  // value of the input in 8-byte LE\\n        hex"00000000",  // input nSequence\\n        \\_hashOutputs,  // hash of the single output\\n        hex"00000000",  // nLockTime\\n        hex"01000000"  // SIGHASH\\_ALL\\n    );\\n    return \\_sighashPreimage.hash256();\\n}\\n```\\n