Apply recommendation

errors.go

@@ -21,15 +21,15 @@ var (
 
 	// ErrParseTime indicates there was an issue parsing the time parameter from the hash
 	// input string, possibly was not expected integer value.
-	ErrParseTime = errors.New("unable to parse time parameter")
+	ErrParseTime = errors.New("unable to parse time parameter or invalid integer for bitsize")
 
 	// ErrParseMemory indicates there was an issue parsing the memory parameter from the hash
 	// input string, possibly was not expected integer value.
-	ErrParseMemory = errors.New("unable to parse memory parameter")
+	ErrParseMemory = errors.New("unable to parse memory parameter or invalid integer for bitsize")
 
 	// ErrParseParallelism indicates there was an issue parsing the parallelism parameter from the hash
 	// input string, possibly was not expected integer value.
-	ErrParseParallelism = errors.New("unable to parse parallelism/threads parameter")
+	ErrParseParallelism = errors.New("unable to parse parallelism/threads parameter or invalid integer for bitsize")
 
 	// ErrHashMismatch indicates the Argon2 digest regenerated using the hash input string salt
 	// and user password input did not produce a matching value. Passphrase input does not match

password.go

@@ -271,17 +271,17 @@ func parseParams(inputParams string) (out *ArgonParams, err error) {
 	// expected format: m=65536,t=2,p=4
 	part := strings.Split(inputParams, ",")
 
-	mem, err := strconv.Atoi(strings.TrimPrefix(part[0], "m="))
+	mem, err := strconv.ParseUint(strings.TrimPrefix(part[0], "m="), 10, 32)
 	if err != nil {
 		return out, ErrParseMemory
 	}
 
-	timeCost, err := strconv.Atoi(strings.TrimPrefix(part[1], "t="))
+	timeCost, err := strconv.ParseUint(strings.TrimPrefix(part[1], "t="), 10, 32)
 	if err != nil {
 		return out, ErrParseTime
 	}
 
-	parallelism, err := strconv.Atoi(strings.TrimPrefix(part[2], "p="))
+	parallelism, err := strconv.ParseUint(strings.TrimPrefix(part[2], "p="), 10, 8)
 	if err != nil {
 		return out, ErrParseParallelism
 	}

password_test.go

@@ -3,6 +3,7 @@ package argonpass
 import (
 	"encoding/base64"
 	"fmt"
+	"math"
 	"math/rand"
 	"strings"
 	"testing"
@@ -249,15 +250,22 @@ func TestParseParams(t *testing.T) {
 		Parallelism: 4,
 	}
 	params, err := parseParams("m=65536,t=2,p=4")
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, expected, params)
 
 	// Test with bad params, these should not happen in regular use since these would fail regex
 	_, err = parseParams("m=65.536,t=2,p=4")
-	assert.EqualError(t, err, ErrParseMemory.Error())
+	require.EqualError(t, err, ErrParseMemory.Error())
 	_, err = parseParams("m=65536,t=2b,p=4")
-	assert.EqualError(t, err, ErrParseTime.Error())
+	require.EqualError(t, err, ErrParseTime.Error())
 	_, err = parseParams("m=65536,t=2,p=4h")
+	require.EqualError(t, err, ErrParseParallelism.Error())
+	// Test out of bounds integers
+	_, err = parseParams(fmt.Sprintf("m=%d,t=2,p=4", math.MaxUint32+1000))
+	assert.EqualError(t, err, ErrParseMemory.Error())
+	_, err = parseParams(fmt.Sprintf("m=65536,t=%d,p=4", math.MaxUint32+10000))
+	assert.EqualError(t, err, ErrParseTime.Error())
+	_, err = parseParams(fmt.Sprintf("m=65536,t=2,p=%d", math.MaxUint8+10000))
 	assert.EqualError(t, err, ErrParseParallelism.Error())
 
 	fmt.Println(" - " + t.Name() + " complete - ")