clamp argon2 memory when parsing untrusted packets

[knQzx]

The Argon2 memory parameter from an untrusted S2K packet is used to size an allocation with no upper bound, so a small packet can request terabytes of memory. This clamps the memory parameter to a sane maximum.

[twiss]

Hi 👋 Thanks for the PR. However, I'd argue this should be a config parameter, because not everybody might agree what is a "sane maximum". For example, we could add a MaxMemory field to Argon2Config, and extend it to be passed during decryption as well as during generation. (It would be best not to outright fail when parsing such packets.)

[knQzx]

done. MaxMemory on Argon2Config, default 2 GiB. the check moved into Params.FunctionWithConfig, so a huge memoryExp parses fine and only fails at derivation. Serialize passes the config too

getting it down to decrypt needed a few *WithConfig variants, old ones delegate with nil like EncryptWithConfig. side effect: we keep s2kParams now instead of the built closure, so s2k errors surface at decrypt instead of parse

[knQzx]

if you have any other suggestions, I'm fully open!!

[twiss]

Awesome, thanks! Some small nits below.

[knQzx]

all four applied. MaxMemoryUsage is public now and sits at the bottom of s2k_config.go, and I tweaked the S2KConfig doc in packet/config.go too so it mentions decryption