AVM: Catch any panic in edcsa verifying

[jannotti]

Return false from ecdsa_verify if library panics.

[codecov]

Codecov Report

Merging #4368 (d7c87d7) into master (00b37f2) will increase coverage by 0.01%.
The diff coverage is 86.36%.

@@            Coverage Diff             @@
##           master    #4368      +/-   ##
==========================================
+ Coverage   55.28%   55.30%   +0.01%     
==========================================
  Files         398      398              
  Lines       50336    50340       +4     
==========================================
+ Hits        27829    27839      +10     
+ Misses      20178    20173       -5     
+ Partials     2329     2328       -1     

Impacted Files	Coverage Δ
data/transactions/logic/eval.go	89.45% <86.36%> (-0.10%)	⬇️
agreement/cryptoVerifier.go	67.60% <0.00%> (-2.12%)	⬇️
agreement/proposalManager.go	96.07% <0.00%> (-1.97%)	⬇️
catchup/peerSelector.go	98.95% <0.00%> (-1.05%)	⬇️
cmd/tealdbg/debugger.go	72.69% <0.00%> (-0.81%)	⬇️
ledger/acctupdates.go	69.59% <0.00%> (-0.60%)	⬇️
catchup/service.go	69.38% <0.00%> (ø)
network/wsNetwork.go	64.82% <0.00%> (+0.19%)	⬆️
network/wsPeer.go	68.21% <0.00%> (+2.73%)	⬆️
ledger/tracker.go	77.87% <0.00%> (+2.97%)	⬆️
... and 1 more

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[michaeldiamant]

For more complete context, here's the commit changing Go behavior: golang/go@a218b35.

[cce]

Invalid points would have led to false before too, right?

[jannotti]

Invalid points would have led to false before too, right?

I sure hope so!

I am a little worried about this fix, because it assume nothing used to panic. If there was something that caused a panic before, that thing would now be caught and cause 0 instead of a guaranteed program failure.

I have done an alternate that explicitly tests for being on the curve instead. Maybe that's better?

[michaeldiamant]

Leaving a note for when we return to the PR: I'm open to discussion, but initial my preference is to catch the specific failure condition rather than the catch-all presented by the PR.

Additionally - I opened an issue to track upgrading to Go v1.19 with a checklist item referencing this PR: #4759. Intent is to confirm we finalize the PR prior to completing a v1.19 upgrade.