fix: prevent certain offset values to address out of hashBytes

[szabolcsnagy]

The HMAC signature only contains 20 hashBytes and if the offset value is the maximum possible 15 the offset + 5 and greater indexes are out of bounds.
This PR will check if those are indexes are valid.

This is related to issue #21.

[szabolcsnagy]

I can add tests, but I need to export generateHOTP because I need to fix the counter value to trigger the offset that is too high. Is it okay if I export that function?

[kentcdodds]

Can you write a test to check for this bug? Make sure it fails without these changes.

[kentcdodds]

Thank you!

[github-actions]

🎉 This PR is included in version 3.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[kentcdodds]

This has been reverted because it broke base 2fa functionality. I welcome a contribution which adds this back but does not break this test: 52dabf0

Sorry for the trouble and thank you!

[szabolcsnagy]

Alright, I can look into it. I wonder if you tested the new version with an actual authenticator app. It doesn't seem to work for me with Google Authenticator.

[kentcdodds]

Just tested with one password, and yes it is broken. We need your fix, and we need to make sure that we pass the automated test. At least we need to figure out what is wrong with the automated test.

[szabolcsnagy]

I opened a PR that fix that issue.