fix: validate salt rounds to prevent hang on negative values

bcrypt.js

@@ -14,6 +14,8 @@ function genSaltSync(rounds, minor) {
         rounds = 10;
     } else if (typeof rounds !== 'number') {
         throw new Error('rounds must be a number');
+    } else if (rounds < 0) {
+        throw new Error('rounds must be a positive integer');
     }
 
     if (!minor) {
@@ -57,6 +59,12 @@ function genSalt(rounds, minor, cb) {
         return process.nextTick(function () {
             cb(error);
         });
+    } else if (rounds < 0) {
+        // callback error asynchronously
+        error = new Error('rounds must be a positive integer');
+        return process.nextTick(function () {
+            cb(error);
+        });
     }
 
     if (!minor) {
@@ -145,8 +153,11 @@ function hash(data, salt, cb) {
 
 
     if (typeof salt === 'number') {
-        return module.exports.genSalt(salt, function (err, salt) {
-            return bindings.encrypt(data, salt, cb);
+        return module.exports.genSalt(salt, function (err, generatedSalt) {
+            if (err) {
+                return cb(err);
+            }
+            return bindings.encrypt(data, generatedSalt, cb);
         });
     }
 

test/async.test.js

@@ -207,3 +207,21 @@ test('hash_compare_one_param', done => {
         done();
     });
 })
+
+test('salt_rounds_is_negative', done => {
+    expect.assertions(2);
+    bcrypt.genSalt(-1, function (err, salt) {
+        expect(err instanceof Error).toBe(true)
+        expect(err.message).toBe('rounds must be a positive integer')
+        done();
+    });
+})
+
+test('hash_rounds_is_negative', done => {
+    expect.assertions(2);
+    bcrypt.hash('password', -1, function (err, hash) {
+        expect(err instanceof Error).toBe(true)
+        expect(err.message).toBe('rounds must be a positive integer')
+        done();
+    });
+})

test/promise.test.js

@@ -23,6 +23,10 @@ test('salt_rounds_is_string_non_number', () => {
     return expect(bcrypt.genSalt('b')).rejects.toThrow('rounds must be a number');
 })
 
+test('salt_rounds_is_negative', () => {
+    return expect(bcrypt.genSalt(-1)).rejects.toThrow('rounds must be a positive integer');
+})
+
 test('hash_returns_promise_on_null_callback', () => {
     expect(typeof bcrypt.hash('password', 10, null).then).toStrictEqual('function')
 })
@@ -57,6 +61,10 @@ test('hash_one_param', () => {
     return expect(bcrypt.hash('password')).rejects.toThrow('data and salt arguments required');
 })
 
+test('hash_rounds_is_negative', () => {
+    return expect(bcrypt.hash('password', -1)).rejects.toThrow('rounds must be a positive integer');
+})
+
 test('hash_salt_validity', () => {
     expect.assertions(2);
     return Promise.all(

test/sync.test.js

@@ -123,3 +123,11 @@ test('getRounds', () => {
     expect(9).toStrictEqual(bcrypt.getRounds(hash))
     expect(() => bcrypt.getRounds('')).toThrow("invalid hash provided");
 });
+
+test('salt_rounds_is_negative', () => {
+    expect(() => bcrypt.genSaltSync(-1)).toThrowError('rounds must be a positive integer');
+})
+
+test('hash_rounds_is_negative', () => {
+    expect(() => bcrypt.hashSync('password', -1)).toThrowError('rounds must be a positive integer');
+})