do not trust the server-returned salt string to be 12 or more chars,

...avoiding a crash when a 1.7 client connects to a 1.6 server

src/multiplayer.cpp

@@ -251,6 +251,11 @@ static server_type open_connection(game_display& disp, const std::string& origin
 
 								const std::string salt = (*error)["salt"];
 
+								if (salt.length() < 12) {
+									//TODO gettextify after end of stringfreeze
+									throw network::error("Bad data received from server");
+								}
+
 								sp["password"] = util::create_hash(util::create_hash(password, util::get_salt(salt),
 										util::get_iteration_count(salt)), salt.substr(12, 8));