restrict llen range heavily

Author: reaperhulk

src/rust/src/backend/kdf.rs

@@ -1809,10 +1809,13 @@ fn validate_kbkdf_parameters(
         ));
     }
 
-    if llen == Some(0) {
-        return Err(CryptographyError::from(
-            pyo3::exceptions::PyValueError::new_err("llen must be non-zero"),
-        ));
+    if let Some(l) = llen {
+        // 4 is an arbitrary limit -- if a use case requires more please file an issue
+        if !(1..=4).contains(&l) {
+            return Err(CryptographyError::from(
+                pyo3::exceptions::PyValueError::new_err("llen must be between 1 and 4"),
+            ));
+        }
     }
 
     Ok(KbkdfParams {

tests/hazmat/primitives/test_kbkdf.py

@@ -212,44 +212,15 @@ def test_rlen(self, backend):
                 backend=backend,
             )
 
-    def test_r_type(self, backend):
-        with pytest.raises(TypeError):
-            KBKDFHMAC(
-                hashes.SHA1(),
-                Mode.CounterMode,
-                32,
-                b"r",  # type: ignore[arg-type]
-                4,
-                CounterLocation.BeforeFixed,
-                b"label",
-                b"context",
-                None,
-                backend=backend,
-            )
-
-    def test_zero_llen(self, backend):
+    @pytest.mark.parametrize("llen", [0, 5])
+    def test_invalid_llen(self, llen, backend):
         with pytest.raises(ValueError):
             KBKDFHMAC(
                 hashes.SHA256(),
                 Mode.CounterMode,
                 32,
                 4,
-                0,
-                CounterLocation.BeforeFixed,
-                b"label",
-                b"context",
-                None,
-                backend=backend,
-            )
-
-    def test_l_type(self, backend):
-        with pytest.raises(TypeError):
-            KBKDFHMAC(
-                hashes.SHA1(),
-                Mode.CounterMode,
-                32,
-                4,
-                b"l",  # type: ignore[arg-type]
+                llen,
                 CounterLocation.BeforeFixed,
                 b"label",
                 b"context",