Check if data is long enough to be decrypted

cmd/backend/users.go

@@ -117,6 +117,9 @@ func aesDecrypt(c *Config, ciphertext string) (string, error) {
 	}
 
 	nonceSize := gcm.NonceSize()
+	if len(data) < nonceSize {
+		return "", errors.New("ciphertext too short")
+	}
 	nonce, cipherText := data[:nonceSize], data[nonceSize:]
 
 	plaintext, err := gcm.Open(nil, nonce, cipherText, nil)