plugin: reject negative file indexes

Reported by Joe Doyle of Trail of Bits.

plugin/client_test.go

@@ -67,6 +67,23 @@ func (testPQCRecipient) WrapWithLabels(fileKey []byte) ([]*age.Stanza, []string,
 	return []*age.Stanza{{Type: "test", Body: fileKey}}, []string{"postquantum"}, nil
 }
 
+func TestIdentityV1NegativeIndex(t *testing.T) {
+	p, err := New("test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	p.HandleIdentity(func([]byte) (age.Identity, error) { return nil, nil })
+	stderr := &bytes.Buffer{}
+	p.SetIO(strings.NewReader("-> recipient-stanza -1 X25519\n\n"), io.Discard, stderr)
+	if code := p.IdentityV1(); code != 1 {
+		t.Errorf("exit code = %d, want 1", code)
+	}
+	want := "unexpected file index -1, previous was -1"
+	if got := stderr.String(); got != want {
+		t.Errorf("stderr = %q, want %q", got, want)
+	}
+}
+
 func TestLabels(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("Windows support is TODO")

plugin/plugin.go

@@ -399,6 +399,9 @@ ReadLoop:
 			if err != nil {
 				return p.fatalf("failed to parse recipient-stanza stanza argument: %v", err)
 			}
+			if i < 0 {
+				return p.fatalf("unexpected file index %d, previous was %d", i, len(files)-1)
+			}
 			ss := &age.Stanza{Type: s.Args[1], Args: s.Args[2:], Body: s.Body}
 			switch i {
 			case len(files):