Add error handling for hashSplit array length < 5 (invalid PBKDF2 has…

…h format)

Add error handling to catch error on determine iterations via strconv.Atoi

common/utils.go

@@ -133,24 +133,34 @@ func HashCompare(password string, passwordHash string, saltEncoding string) bool
  //log.Debugf("Supplied: ", passwordHash)
  // Split the hash string into its parts.
  hashSplit := strings.Split(passwordHash, "$")
+ // Check array is of expected length
+ if len(hashSplit) != 5 {
+ log.Errorf("HashCompare, invalid PBKDF2 hash supplied!")
+ return false
+ }
+ // Define empty error
+ var err error
  // Get the iterations from PBKDF2 string
- iterations, _ := strconv.Atoi(hashSplit[2])
+ iterations, err := strconv.Atoi(hashSplit[2])
+ if err != nil {
+ log.Errorf("Error getting number of iterations from PBKDF2 hash!")
+ return false
+ }
  // Convert salt to bytes, using encoding supplied in saltEncoding param
  salt := []byte{}
- var err error
  if saltEncoding == "utf-8" {
  salt = []byte(hashSplit[3])
  } else {
  salt, err = base64.StdEncoding.DecodeString(hashSplit[3])
  if err != nil {
- log.Errorf("Error decoding supplied base64 salt")
+ log.Errorf("Error decoding supplied base64 salt!")
  return false
  }
  }
  // Work out key length, assumes base64 encoding
  hash, err := base64.StdEncoding.DecodeString(hashSplit[4])
  if err != nil {
- log.Errorf("Error decoding supplied base64 hash")
+ log.Errorf("Error decoding supplied base64 hash!")
  return false
  }
  keylen := len(hash)