test `b3sum --keyed` with bad key lengths

2 files changed, 11 insertions, 2 deletions

diff --git a/b3sum/src/main.rs b/b3sum/src/main.rs
index 0715024..91a87a1 100644
--- a/b3sum/src/main.rs
+++ b/b3sum/src/main.rs
@@ -304,13 +304,13 @@ fn read_key_from_stdin() -> Result<[u8; blake3::KEY_LEN]> {
         .lock()
         .take(blake3::KEY_LEN as u64 + 1)
         .read_to_end(&mut bytes)?;
-    if n < 32 {
+    if n < blake3::KEY_LEN {
         bail!(
             "expected {} key bytes from stdin, found {}",
             blake3::KEY_LEN,
             n,
         )
-    } else if n > 32 {
+    } else if n > blake3::KEY_LEN {
         bail!("read more than {} key bytes from stdin", blake3::KEY_LEN)
     } else {
         Ok(bytes[..blake3::KEY_LEN].try_into().unwrap())
diff --git a/b3sum/tests/cli_tests.rs b/b3sum/tests/cli_tests.rs
index 7ecf8b9..6b0ca5a 100644
--- a/b3sum/tests/cli_tests.rs
+++ b/b3sum/tests/cli_tests.rs
@@ -113,6 +113,15 @@ fn test_keyed() {
         .read()
         .unwrap();
     assert_eq!(&*expected, &*output);
+
+    // Make sure that keys of the wrong length lead to errors.
+    for bad_length in [0, 1, blake3::KEY_LEN - 1, blake3::KEY_LEN + 1] {
+        dbg!(bad_length);
+        cmd!(b3sum_exe(), "--keyed", f.path())
+            .stdin_bytes(vec![0; bad_length])
+            .read()
+            .expect_err("a bad length key should fail");
+    }
 }
 
 #[test]