bounds check comparing polynomials (#56)

* bounds check when comparing polynomials
* added extra check of threshold
* fixing comment on PubPoly Equal being constant time

---------

Co-authored-by: Yolan Romailler <anomalroil@users.noreply.github.com>

share/poly.go

@@ -379,14 +379,19 @@ func (p *PubPoly) Add(q *PubPoly) (*PubPoly, error) {
 }
 
 // Equal checks equality of two public commitment polynomials p and q. If p and
-// q are trivially unequal (e.g., due to mismatching cryptographic groups),
+// q are trivially unequal (e.g., due to mismatching cryptographic groups, or threshold issues),
 // this routine returns in variable time. Otherwise it runs in constant time
 // regardless of whether it eventually returns true or false.
 func (p *PubPoly) Equal(q *PubPoly) bool {
 	if p.g.String() != q.g.String() {
 		return false
 	}
 	b := 1
+
+	if len(p.commits) < p.Threshold() || len(q.commits) < p.Threshold() || p.Threshold() != q.Threshold() {
+		return false
+	}
+
 	for i := 0; i < p.Threshold(); i++ {
 		pb, _ := p.commits[i].MarshalBinary()
 		qb, _ := q.commits[i].MarshalBinary()