Yes, indeed. The pre-patch version didn't have length checks either, but it didn't matter with only (proof, commitment). A very well intended security patch that exposed a pre-existing flaw. Fucking hell software is hard!