{"record":{"id":"1ef4932cadef263e","repo":"slackhq/nebula","slug":"argon2parameters-version-must-be-at-least-d-and-n","errorCode":null,"errorMessage":"Argon2Parameters Version must be at least %d and no more than %d","messagePattern":"Argon2Parameters Version must be at least (.+?) and no more than (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/crypto.go","lineNumber":231,"sourceCode":"\tparams, err := unmarshalArgon2Parameters(rned.EncryptionMetadata.Argon2Parameters)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tned := NebulaEncryptedData{\n\t\tEncryptionMetadata: NebulaEncryptionMetadata{\n\t\t\tEncryptionAlgorithm: rned.EncryptionMetadata.EncryptionAlgorithm,\n\t\t\tArgon2Parameters:    *params,\n\t\t},\n\t\tCiphertext: rned.Ciphertext,\n\t}\n\n\treturn &ned, nil\n}\n\nfunc unmarshalArgon2Parameters(params *RawNebulaArgon2Parameters) (*Argon2Parameters, error) {\n\tif params.Version < math.MinInt32 || params.Version > math.MaxInt32 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Version must be at least %d and no more than %d\", math.MinInt32, math.MaxInt32)\n\t}\n\tif params.Memory <= 0 || params.Memory > math.MaxUint32 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Memory must be be greater than 0 and no more than %d KiB\", uint32(math.MaxUint32))\n\t}\n\tif params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Parallelism must be be greater than 0 and no more than %d\", math.MaxUint8)\n\t}\n\tif params.Iterations <= 0 || params.Iterations > math.MaxUint32 {\n\t\treturn nil, fmt.Errorf(\"-argon-iterations must be be greater than 0 and no more than %d\", uint32(math.MaxUint32))\n\t}\n\n\treturn &Argon2Parameters{\n\t\tversion:     params.Version,\n\t\tMemory:      params.Memory,\n\t\tParallelism: uint8(params.Parallelism),\n\t\tIterations:  params.Iterations,\n\t\tsalt:        params.Salt,\n\t}, nil","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/crypto.go#L213-L249","documentation":"unmarshalArgon2Parameters bounds the Argon2 version field to the int32 range before it is narrowed to the internal int representation. A version outside [-2147483648, 2147483647] is rejected because it cannot be a valid Argon2 version (real versions are small, e.g. 0x13).","triggerScenarios":"Deserializing a RawNebulaArgon2Parameters whose Version field (a 64-bit int) exceeds int32 bounds - only possible with maliciously or accidentally corrupted data, since legitimate Argon2 versions are tiny positive numbers.","commonSituations":"Processing untrusted/corrupted encrypted-data blobs; a bug in external tooling writing garbage version values; fuzz tests exploring hostile inputs.","solutions":["Treat this as corrupt/hostile input: reject the blob; it cannot contain a valid Argon2 version","If this appears with data from your own tool, fix the serialization bug that wrote an out-of-range version","Re-encrypt the data with the library's own EncryptAndMarshal* helpers, which write argon2.Version"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if params.Version < math.MinInt32 || params.Version > math.MaxInt32 { return fmt.Errorf(\"version out of int32 range\") }","typeGuard":null,"tryCatchPattern":"ned, err := cert.UnmarshalNebulaEncryptedData(untrustedBlob)\nif err != nil {\n    if strings.Contains(err.Error(), \"Argon2Parameters Version must be\") { /* reject hostile/corrupt input */ }\n    return err\n}","preventionTips":["Never trust Argon2 parameters from untrusted sources; validate before use","Only write argon2.Version as the version field when serializing","Fuzz/validate any externally produced encrypted-data blobs"],"tags":["crypto","argon2","bounds-check","protobuf"],"backgroundTag":"invalid-crypto-parameter","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}