diff --git a/errors.go b/errors.go index c5dfdb6..942d820 100644 --- a/errors.go +++ b/errors.go @@ -21,15 +21,15 @@ var ( // ErrParseTime indicates there was an issue parsing the time parameter from the hash // input string, possibly was not expected integer value. - ErrParseTime = errors.New("unable to parse time parameter") + ErrParseTime = errors.New("unable to parse time parameter or invalid integer for bitsize") // ErrParseMemory indicates there was an issue parsing the memory parameter from the hash // input string, possibly was not expected integer value. - ErrParseMemory = errors.New("unable to parse memory parameter") + ErrParseMemory = errors.New("unable to parse memory parameter or invalid integer for bitsize") // ErrParseParallelism indicates there was an issue parsing the parallelism parameter from the hash // input string, possibly was not expected integer value. - ErrParseParallelism = errors.New("unable to parse parallelism/threads parameter") + ErrParseParallelism = errors.New("unable to parse parallelism/threads parameter or invalid integer for bitsize") // ErrHashMismatch indicates the Argon2 digest regenerated using the hash input string salt // and user password input did not produce a matching value. Passphrase input does not match diff --git a/password.go b/password.go index c44cf2a..846b854 100644 --- a/password.go +++ b/password.go @@ -271,17 +271,17 @@ func parseParams(inputParams string) (out *ArgonParams, err error) { // expected format: m=65536,t=2,p=4 part := strings.Split(inputParams, ",") - mem, err := strconv.Atoi(strings.TrimPrefix(part[0], "m=")) + mem, err := strconv.ParseUint(strings.TrimPrefix(part[0], "m="), 10, 32) if err != nil { return out, ErrParseMemory } - timeCost, err := strconv.Atoi(strings.TrimPrefix(part[1], "t=")) + timeCost, err := strconv.ParseUint(strings.TrimPrefix(part[1], "t="), 10, 32) if err != nil { return out, ErrParseTime } - parallelism, err := strconv.Atoi(strings.TrimPrefix(part[2], "p=")) + parallelism, err := strconv.ParseUint(strings.TrimPrefix(part[2], "p="), 10, 8) if err != nil { return out, ErrParseParallelism } diff --git a/password_test.go b/password_test.go index bd99dc3..52e528e 100644 --- a/password_test.go +++ b/password_test.go @@ -3,6 +3,7 @@ package argonpass import ( "encoding/base64" "fmt" + "math" "math/rand" "strings" "testing" @@ -249,15 +250,22 @@ func TestParseParams(t *testing.T) { Parallelism: 4, } params, err := parseParams("m=65536,t=2,p=4") - assert.NoError(t, err) + require.NoError(t, err) assert.Equal(t, expected, params) // Test with bad params, these should not happen in regular use since these would fail regex _, err = parseParams("m=65.536,t=2,p=4") - assert.EqualError(t, err, ErrParseMemory.Error()) + require.EqualError(t, err, ErrParseMemory.Error()) _, err = parseParams("m=65536,t=2b,p=4") - assert.EqualError(t, err, ErrParseTime.Error()) + require.EqualError(t, err, ErrParseTime.Error()) _, err = parseParams("m=65536,t=2,p=4h") + require.EqualError(t, err, ErrParseParallelism.Error()) + // Test out of bounds integers + _, err = parseParams(fmt.Sprintf("m=%d,t=2,p=4", math.MaxUint32+1000)) + assert.EqualError(t, err, ErrParseMemory.Error()) + _, err = parseParams(fmt.Sprintf("m=65536,t=%d,p=4", math.MaxUint32+10000)) + assert.EqualError(t, err, ErrParseTime.Error()) + _, err = parseParams(fmt.Sprintf("m=65536,t=2,p=%d", math.MaxUint8+10000)) assert.EqualError(t, err, ErrParseParallelism.Error()) fmt.Println(" - " + t.Name() + " complete - ")