Panic when decoding bech32 string containing an uppercase 'O'

[sgeisler]

Fuzz tests in rust-bitcoin/rust-bitcoin#100 uncovered the bug that if the bech32 data part contains an uppercase 'O' the parser panics. This is due to insufficient checks that only check the lowercase variants of the forbidden characters (before normalizing them to their lowercase variant):

if b == b'1' || b == b'b' || b == b'i' || b == b'o' {
    return Err(Error::InvalidChar(b))
}

To avoid such issues in the future I will have a look at fuzz testing this crate (#21).

[sgeisler]

I had a look at the code from before the introduction of u5. The same bug was present before (silently outputting vectors with elements >=32, in this case 255) and only uncoverd by the range checks of u5. I will open a fix PR soon.

[clarkmoody]

Well that certainly is a bug! What were you thinking of using for fuzz testing?

[sgeisler]

The fuzzing code can probaly be copied from rust-bitcoin with some minor changes. The main objective will be to find panic scenarios (we don't need reference data for that). I'd say a stretch goal is to link the C/C++ version from bitcoin core as a reference and check if they can cope with each other's output/produce the same output given the same input.