apps/passwd.c:772: error: BUFFER_OVERRUN_L3
  Offset: 16 Size: [3, 17].
Showing all 3 steps of the trace


apps/passwd.c:716:1: <Length trace>
714.   # endif
715.   
716. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
717.                        char *passwd, BIO *out, int quiet, int table,
718.                        int reverse, size_t pw_maxlen, passwd_modes mode)

apps/passwd.c:716:1: Parameter `**salt_p`
714.   # endif
715.   
716. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
717.                        char *passwd, BIO *out, int quiet, int table,
718.                        int reverse, size_t pw_maxlen, passwd_modes mode)

apps/passwd.c:772:13: Array access: Offset: 16 Size: [3, 17]
770.               for (i = 0; i < 16; i++)
771.                   (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */
772.               (*salt_p)[16] = 0;
                   ^
773.           }
774.   # endif                         /* !NO_SHACRYPT */

static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
                     char *passwd, BIO *out, int quiet, int table,
                     int reverse, size_t pw_maxlen, passwd_modes mode)
{
    char *hash = NULL;
    assert(salt_p != NULL);
    assert(salt_malloc_p != NULL);
    if (!passed_salt) {
# ifndef OPENSSL_NO_DES
        if (mode == passwd_crypt) {
            if (*salt_malloc_p == NULL) {
                *salt_p = *salt_malloc_p = app_malloc(3, "salt buffer");
            }
            if (RAND_bytes((unsigned char *)*salt_p, 2) <= 0)
                goto end;
            (*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f];
            (*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f];
            (*salt_p)[2] = 0;
#  ifdef CHARSET_EBCDIC
            ascii2ebcdic(*salt_p, *salt_p, 2);
#  endif
        }
# endif
# ifndef NO_MD5CRYPT_1
        if (mode == passwd_md5 || mode == passwd_apr1) {
            int i;
            if (*salt_malloc_p == NULL) {
                *salt_p = *salt_malloc_p = app_malloc(9, "salt buffer");
            }
            if (RAND_bytes((unsigned char *)*salt_p, 8) <= 0)
                goto end;
            for (i = 0; i < 8; i++)
                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];
            (*salt_p)[8] = 0;
        }
# endif
# ifndef NO_SHACRYPT
        if (mode == passwd_sha256 || mode == passwd_sha512) {
            int i;
            if (*salt_malloc_p == NULL) {
                *salt_p = *salt_malloc_p = app_malloc(17, "salt buffer");
            }
            if (RAND_bytes((unsigned char *)*salt_p, 16) <= 0)
                goto end;
            for (i = 0; i < 16; i++)
                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];
            (*salt_p)[16] = 0;
        }
# endif
    }
    assert(*salt_p != NULL);
    if ((strlen(passwd) > pw_maxlen)) {
        if (!quiet)
            BIO_printf(bio_err,
                       "Warning: truncating password to %u characters\n",
                       (unsigned)pw_maxlen);
        passwd[pw_maxlen] = 0;
    }
    assert(strlen(passwd) <= pw_maxlen);
# ifndef OPENSSL_NO_DES
    if (mode == passwd_crypt)
        hash = DES_crypt(passwd, *salt_p);
# endif
# ifndef NO_MD5CRYPT_1
    if (mode == passwd_md5 || mode == passwd_apr1)
        hash = md5crypt(passwd, (mode == passwd_md5 ? "1" : "apr1"), *salt_p);
# endif
# ifndef NO_SHACRYPT
    if (mode == passwd_sha256 || mode == passwd_sha512)
        hash = shacrypt(passwd, (mode == passwd_sha256 ? "5" : "6"), *salt_p);
# endif
    assert(hash != NULL);
    if (table && !reverse)
        BIO_printf(out, "%s\t%s\n", passwd, hash);
    else if (table && reverse)
        BIO_printf(out, "%s\t%s\n", hash, passwd);
    else
        BIO_printf(out, "%s\n", hash);
    return 1;
 end:
    return 0;
}
['static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,\n                     char *passwd, BIO *out, int quiet, int table,\n                     int reverse, size_t pw_maxlen, passwd_modes mode)\n{\n    char *hash = NULL;\n    assert(salt_p != NULL);\n    assert(salt_malloc_p != NULL);\n    if (!passed_salt) {\n# ifndef OPENSSL_NO_DES\n        if (mode == passwd_crypt) {\n            if (*salt_malloc_p == NULL) {\n                *salt_p = *salt_malloc_p = app_malloc(3, "salt buffer");\n            }\n            if (RAND_bytes((unsigned char *)*salt_p, 2) <= 0)\n                goto end;\n            (*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f];\n            (*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f];\n            (*salt_p)[2] = 0;\n#  ifdef CHARSET_EBCDIC\n            ascii2ebcdic(*salt_p, *salt_p, 2);\n#  endif\n        }\n# endif\n# ifndef NO_MD5CRYPT_1\n        if (mode == passwd_md5 || mode == passwd_apr1) {\n            int i;\n            if (*salt_malloc_p == NULL) {\n                *salt_p = *salt_malloc_p = app_malloc(9, "salt buffer");\n            }\n            if (RAND_bytes((unsigned char *)*salt_p, 8) <= 0)\n                goto end;\n            for (i = 0; i < 8; i++)\n                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];\n            (*salt_p)[8] = 0;\n        }\n# endif\n# ifndef NO_SHACRYPT\n        if (mode == passwd_sha256 || mode == passwd_sha512) {\n            int i;\n            if (*salt_malloc_p == NULL) {\n                *salt_p = *salt_malloc_p = app_malloc(17, "salt buffer");\n            }\n            if (RAND_bytes((unsigned char *)*salt_p, 16) <= 0)\n                goto end;\n            for (i = 0; i < 16; i++)\n                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];\n            (*salt_p)[16] = 0;\n        }\n# endif\n    }\n    assert(*salt_p != NULL);\n    if ((strlen(passwd) > pw_maxlen)) {\n        if (!quiet)\n            BIO_printf(bio_err,\n                       "Warning: truncating password to %u characters\\n",\n                       (unsigned)pw_maxlen);\n        passwd[pw_maxlen] = 0;\n    }\n    assert(strlen(passwd) <= pw_maxlen);\n# ifndef OPENSSL_NO_DES\n    if (mode == passwd_crypt)\n        hash = DES_crypt(passwd, *salt_p);\n# endif\n# ifndef NO_MD5CRYPT_1\n    if (mode == passwd_md5 || mode == passwd_apr1)\n        hash = md5crypt(passwd, (mode == passwd_md5 ? "1" : "apr1"), *salt_p);\n# endif\n# ifndef NO_SHACRYPT\n    if (mode == passwd_sha256 || mode == passwd_sha512)\n        hash = shacrypt(passwd, (mode == passwd_sha256 ? "5" : "6"), *salt_p);\n# endif\n    assert(hash != NULL);\n    if (table && !reverse)\n        BIO_printf(out, "%s\\t%s\\n", passwd, hash);\n    else if (table && reverse)\n        BIO_printf(out, "%s\\t%s\\n", hash, passwd);\n    else\n        BIO_printf(out, "%s\\n", hash);\n    return 1;\n end:\n    return 0;\n}']