Error out on NUL bytes.

bcrypt/__init__.py

@@ -138,6 +138,9 @@ def hashpw(password, salt):
     if isinstance(password, six.text_type) or isinstance(salt, six.text_type):
         raise TypeError("Unicode-objects must be encoded before hashing")
 
+    if b"\x00" in password:
+        raise ValueError("password may not contain NUL bytes")
+
     hashed = _ffi.new("unsigned char[]", 128)
     retval = _bcrypt_lib.crypt_rn(password, salt, hashed, len(hashed))
 

tests/test_bcrypt.py

@@ -264,3 +264,7 @@ def test_hashpw_str_salt():
             b"password",
             six.text_type("$2a$04$cVWp4XaNU8a4v1uMRum2SO"),
         )
+
+def test_nul_byte():
+    with pytest.raises(ValueError):
+        bcrypt.hashpw(b"abc\0def", bcrypt.gensalt(0))