Catch invoice decoding exceptions (#567)

There are a few requirements checked in our secp256k1 wrappers that
may throw exceptions on invalid inputs. It's generally a good idea to
catch exceptions when validating external, untrusted inputs.

build.gradle.kts

@@ -33,7 +33,7 @@ kotlin {
 
     val commonMain by sourceSets.getting {
         dependencies {
-            api("fr.acinq.bitcoin:bitcoin-kmp:0.14.0") // when upgrading, keep secp256k1-kmp-jni-jvm in sync below
+            api("fr.acinq.bitcoin:bitcoin-kmp:0.15.0") // when upgrading, keep secp256k1-kmp-jni-jvm in sync below
             api("org.kodein.log:canard:0.18.0")
             api("org.jetbrains.kotlinx:kotlinx-coroutines-core:$coroutineVersion")
             api("org.jetbrains.kotlinx:kotlinx-serialization-core:$serializationVersion")
@@ -63,7 +63,7 @@ kotlin {
             api(ktor("client-okhttp"))
             api(ktor("network"))
             api(ktor("network-tls"))
-            implementation("fr.acinq.secp256k1:secp256k1-kmp-jni-jvm:0.11.0")
+            implementation("fr.acinq.secp256k1:secp256k1-kmp-jni-jvm:0.12.0")
             implementation("org.slf4j:slf4j-api:1.7.36")
             api("org.xerial:sqlite-jdbc:3.32.3.2")
         }

src/commonMain/kotlin/fr/acinq/lightning/payment/PaymentRequest.kt

@@ -174,7 +174,7 @@ data class PaymentRequest(
             return loop(input, listOf())
         }
 
-        fun read(input: String): PaymentRequest {
+        fun read(input: String): Try<PaymentRequest> = runTrying {
             val (hrp, data) = Bech32.decode(input)
             val prefix = prefixes.values.find { hrp.startsWith(it) } ?: throw IllegalArgumentException("unknown prefix $hrp")
             val amount = decodeAmount(hrp.drop(prefix.length))
@@ -217,8 +217,8 @@ data class PaymentRequest(
 
             loop(data.drop(7).dropLast(104))
             val pr = PaymentRequest(prefix, amount, timestamp, nodeId, tags, sigandrecid.toByteVector())
-            require(pr.signedPreimage().contentEquals(tohash))
-            return pr
+            require(pr.signedPreimage().contentEquals(tohash)) { "invoice isn't canonically encoded" }
+            pr
         }
 
         fun decodeAmount(input: String): MilliSatoshi? {