From f5cef98b3f592d629206cefdffa39971e140f2f9 Mon Sep 17 00:00:00 2001
From: mimi89999 <michel@lebihan.pl>
Date: Tue, 17 Mar 2026 17:22:01 +0100
Subject: [PATCH] Show error for PIN exceeding max length on set and change

---
 app/src/main/java/pl/lebihan/authnkey/OutputFormatter.kt | 8 ++++++++
 app/src/main/java/pl/lebihan/authnkey/PinProtocol.kt     | 8 ++++++++
 app/src/main/res/values/strings.xml                      | 2 ++
 3 files changed, 18 insertions(+)

diff --git a/app/src/main/java/pl/lebihan/authnkey/OutputFormatter.kt b/app/src/main/java/pl/lebihan/authnkey/OutputFormatter.kt
index bb39ed6..a65ccf0 100644
--- a/app/src/main/java/pl/lebihan/authnkey/OutputFormatter.kt
+++ b/app/src/main/java/pl/lebihan/authnkey/OutputFormatter.kt
@@ -273,6 +273,10 @@ class OutputFormatter(private val context: Context) {
             context.getString(R.string.pin_policy_violation_title),
             context.getString(R.string.pin_policy_violation_message)
         )
+        is PinProtocol.PinChangeError.PinTooLong -> status(
+            context.getString(R.string.pin_too_long_title),
+            context.getString(R.string.pin_too_long_message)
+        )
         is PinProtocol.PinChangeError.PinNotSet -> status(
             context.getString(R.string.pin_not_set_title),
             context.getString(R.string.pin_not_set_message)
@@ -306,6 +310,10 @@ class OutputFormatter(private val context: Context) {
             context.getString(R.string.pin_policy_violation_title),
             context.getString(R.string.pin_policy_violation_message)
         )
+        is PinProtocol.PinSetError.PinTooLong -> status(
+            context.getString(R.string.pin_too_long_title),
+            context.getString(R.string.pin_too_long_message)
+        )
         is PinProtocol.PinSetError.PinBlocked -> status(
             context.getString(R.string.pin_blocked_title),
             context.getString(R.string.pin_blocked_message)
diff --git a/app/src/main/java/pl/lebihan/authnkey/PinProtocol.kt b/app/src/main/java/pl/lebihan/authnkey/PinProtocol.kt
index df37437..aa65b1b 100644
--- a/app/src/main/java/pl/lebihan/authnkey/PinProtocol.kt
+++ b/app/src/main/java/pl/lebihan/authnkey/PinProtocol.kt
@@ -216,6 +216,7 @@ class PinProtocol(private val transport: FidoTransport) {
     sealed class PinSetError(message: String) : Exception(message) {
         class PinAlreadySet : PinSetError("A PIN is already set on this authenticator")
         class PinPolicyViolation : PinSetError("PIN does not meet authenticator requirements")
+        class PinTooLong : PinSetError("PIN exceeds maximum allowed length")
         class PinBlocked : PinSetError("PIN is blocked")
         data class Other(val errorName: String) : PinSetError(errorName)
     }
@@ -226,6 +227,9 @@ class PinProtocol(private val transport: FidoTransport) {
 
         try {
             val newPinBytes = newPin.toByteArray(Charsets.UTF_8)
+            if (newPinBytes.size > 63) {
+                return Result.failure(PinSetError.PinTooLong())
+            }
             val newPinPadded = ByteArray(64)
             newPinBytes.copyInto(newPinPadded, 0, 0, newPinBytes.size)
 
@@ -264,6 +268,7 @@ class PinProtocol(private val transport: FidoTransport) {
         class InvalidPin : PinChangeError("Current PIN is incorrect")
         class PinBlocked : PinChangeError("PIN is blocked due to too many incorrect attempts")
         class PinPolicyViolation : PinChangeError("New PIN does not meet authenticator requirements")
+        class PinTooLong : PinChangeError("PIN exceeds maximum allowed length")
         class PinNotSet : PinChangeError("No PIN is set on this authenticator")
         data class Other(val errorName: String) : PinChangeError(errorName)
     }
@@ -279,6 +284,9 @@ class PinProtocol(private val transport: FidoTransport) {
             val currentPinHashLeft16 = currentPinHash.copyOf(16)
 
             val newPinBytes = newPin.toByteArray(Charsets.UTF_8)
+            if (newPinBytes.size > 63) {
+                return Result.failure(PinChangeError.PinTooLong())
+            }
             val newPinPadded = ByteArray(64)
             newPinBytes.copyInto(newPinPadded, 0, 0, newPinBytes.size)
 
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index a0a6399..6b40d19 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -42,6 +42,8 @@
     <string name="pin_hint_confirm">Confirm new PIN</string>
     <string name="pin_continue">Continue</string>
     <string name="pin_too_short">PIN must be at least %1$d characters</string>
+    <string name="pin_too_long_title">PIN Too Long</string>
+    <string name="pin_too_long_message">PIN exceeds maximum allowed length</string>
     <string name="pin_retries_remaining">Enter PIN (%1$d retries remaining)</string>
     <string name="pin_incorrect_retries">Incorrect PIN. %1$d retries remaining</string>