Fix proof size checks reporting off-by-one sizes

proof/verify.go

@@ -91,9 +91,8 @@ func VerifyConsistency(nh NodeHasher, size1, size2 uint64, proof [][]byte, root1
 
 	// Otherwise, the consistency proof is equivalent to an inclusion proof of
 	// its first hash. Verify it below.
-	if got := len(proof); got < 1 {
-		// TODO(pavelkalinnikov): Check proof size earlier, show the expected size.
-		return fmt.Errorf("incorrect proof size: %d", got)
+	if got, want := len(proof), 1+bits.Len64(size2-1)-int(level); got != want {
+		return fmt.Errorf("incorrect proof size: %d, want %d", got, want)
 	}
 	if err := verify(nh, index, level, size2, proof[0], proof[1:], root2); err != nil {
 		return err
@@ -134,8 +133,6 @@ func verify(nh NodeHasher, index uint64, level uint, size uint64, hash []byte, p
 	}
 
 	if got, want := len(proof), inner+right+left; got != want {
-		// TODO(pavelkalinnikov): Fix this error showing off-by-one `got` and
-		// `want` size for consistency proofs where size1 is not a power of 2.
 		return fmt.Errorf("incorrect proof size: %d, want %d", got, want)
 	}