Error out on NUL bytes.

2 files changed, 7 insertions, 0 deletions

diff --git a/bcrypt/__init__.py b/bcrypt/__init__.py
index 0ecafba..29a4701 100644
--- a/bcrypt/__init__.py
+++ b/bcrypt/__init__.py
@@ -138,6 +138,9 @@ def hashpw(password, salt):
     if isinstance(password, six.text_type) or isinstance(salt, six.text_type):
         raise TypeError("Unicode-objects must be encoded before hashing")
 
+    if b"\x00" in password:
+        raise ValueError("password may not contain NUL bytes")
+
     hashed = _ffi.new("unsigned char[]", 128)
     retval = _bcrypt_lib.crypt_rn(password, salt, hashed, len(hashed))
 
diff --git a/tests/test_bcrypt.py b/tests/test_bcrypt.py
index e6329a6..c735dc4 100644
--- a/tests/test_bcrypt.py
+++ b/tests/test_bcrypt.py
@@ -264,3 +264,7 @@ def test_hashpw_str_salt():
             b"password",
             six.text_type("$2a$04$cVWp4XaNU8a4v1uMRum2SO"),
         )
+
+def test_nul_byte():
+    with pytest.raises(ValueError):
+        bcrypt.hashpw(b"abc\0def", bcrypt.gensalt(0))