internal/format: reject headers without recipient stanzas

Reported by Joe Doyle of Trail of Bits.

internal/format/format.go

@@ -135,6 +135,9 @@ func (r *Stanza) Marshal(w io.Writer) error {
 }
 
 func (h *Header) MarshalWithoutMAC(w io.Writer) error {
+	if len(h.Recipients) == 0 {
+		return errors.New("no recipient stanzas")
+	}
 	if _, err := io.WriteString(w, intro); err != nil {
 		return err
 	}
@@ -348,6 +351,9 @@ func Parse(input io.Reader) (*Header, io.Reader, error) {
 		}
 		h.Recipients = append(h.Recipients, s)
 	}
+	if len(h.Recipients) == 0 {
+		return nil, nil, errorf("no recipient stanzas")
+	}
 
 	// If input is a bufio.Reader, rr might be equal to input because
 	// bufio.NewReader short-circuits. In this case we can just return it (and

internal/format/format_test.go

@@ -46,6 +46,16 @@ func TestStanzaMarshal(t *testing.T) {
 	}
 }
 
+func TestHeaderMarshalNoStanzas(t *testing.T) {
+	buf := &bytes.Buffer{}
+	if err := (&format.Header{}).Marshal(buf); err == nil {
+		t.Fatal("Marshal accepted a header with no stanzas")
+	}
+	if buf.Len() != 0 {
+		t.Errorf("Marshal wrote %d bytes", buf.Len())
+	}
+}
+
 func TestParseLimits(t *testing.T) {
 	const (
 		intro          = "age-encryption.org/v1\n"
@@ -93,6 +103,9 @@ func TestParseLimits(t *testing.T) {
 			return []byte(intro + strings.Repeat("-> test\n\n", stanzas) + footer)
 		}
 
+		if _, _, err := format.Parse(bytes.NewReader(makeHeader(0))); err == nil || !strings.Contains(err.Error(), "no recipient stanzas") {
+			t.Fatalf("unexpected zero-stanza error: %v", err)
+		}
 		if _, _, err := format.Parse(bytes.NewReader(makeHeader(1024))); err != nil {
 			t.Fatalf("header with 1024 stanzas was rejected: %v", err)
 		}