Let's say a coin has been locked with a 2-of-3 challenge script. In other words, spending the coin requires two signatures, each of which matches one of three designated public keys.
Now I try to spend the coin with a transaction containing, not two signatures, but three. All three signatures are valid and match a different designated public key.
The complete validation script will contain eight values:
<3>
<PK1>
<PK2>
<PK3>
<2>
<SIG1>
<SIG2>
<SIG3>
<0>
AFAIK, the only way for the interpreter to know the number of signatures is the value <2>, which was provided by the challenge script, not my response script. It seems that the only way for OP_CHECKMULTISIG to know how many signatures to pop is the value <2>.
However, popping only two values leaves the stack like this:
<SIG3>
<0>
Then the interpreter checks to see that the next value on the stack is 0, which it is not:
https://github.com/bitcoin/bitcoin/blob/0.10/src/script/interpreter.cpp#L894
As I understand it, this scenario should lead to failure of the verification script.
Is this correct?