Catch NullPointerException from bouncy castle signature verification. This can be triggered by a specially crafted signature. Thanks to Sergio Damian Lerner for finding this.

core/src/main/java/com/google/bitcoin/core/ECKey.java

@@ -326,6 +326,9 @@ public class ECKey implements Serializable {
             return signer.verifySignature(data, r.getPositiveValue(), s.getPositiveValue());
         } catch (IOException e) {
             throw new RuntimeException(e);
+        } catch (NullPointerException e) {
+            // Bug in BouncyCastle can cause this for invalid signatures.
+            return false;
         }
     }