apps/passwd.c:421: error: BUFFER_OVERRUN_L2
  Offset: [15, 17] Size: 16.
Showing all 5 steps of the trace


apps/passwd.c:412:14: <Offset trace>
410.           *output++ = '$';
411.   
412.           for (i = 0; i < 15; i += 3) {
                    ^
413.               *output++ = cov_2char[buf_perm[i + 2] & 0x3f];
414.               *output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) |

apps/passwd.c:412:14: Assignment
410.           *output++ = '$';
411.   
412.           for (i = 0; i < 15; i += 3) {
                    ^
413.               *output++ = cov_2char[buf_perm[i + 2] & 0x3f];
414.               *output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) |

apps/passwd.c:321:1: <Length trace>
319.    * application of the NIH principle I've ever encountered.)
320.    */
321. > static char *md5crypt(const char *passwd, const char *magic, const char *salt)
322.   {
323.       /* "$apr1$..salt..$.......md5hash..........\0" */

apps/passwd.c:321:1: Array declaration
319.    * application of the NIH principle I've ever encountered.)
320.    */
321. > static char *md5crypt(const char *passwd, const char *magic, const char *salt)
322.   {
323.       /* "$apr1$..salt..$.......md5hash..........\0" */

apps/passwd.c:421:31: Array access: Offset: [15, 17] Size: 16
419.           }
420.           assert(i == 15);
421.           *output++ = cov_2char[buf_perm[i] & 0x3f];
                                     ^
422.           *output++ = cov_2char[buf_perm[i] >> 6];
423.           *output = 0;

static char *md5crypt(const char *passwd, const char *magic, const char *salt)
{
    static char out_buf[6 + 9 + 24 + 2];
    unsigned char buf[MD5_DIGEST_LENGTH];
    char *salt_out;
    int n;
    unsigned int i;
    EVP_MD_CTX *md, *md2;
    size_t passwd_len, salt_len;
    passwd_len = strlen(passwd);
    out_buf[0] = '$';
    out_buf[1] = 0;
    assert(strlen(magic) <= 4);
    OPENSSL_strlcat(out_buf, magic, sizeof out_buf);
    OPENSSL_strlcat(out_buf, "$", sizeof out_buf);
    OPENSSL_strlcat(out_buf, salt, sizeof out_buf);
    assert(strlen(out_buf) <= 6 + 8);
    salt_out = out_buf + 2 + strlen(magic);
    salt_len = strlen(salt_out);
    assert(salt_len <= 8);
    md = EVP_MD_CTX_new();
    if (md == NULL)
        return NULL;
    EVP_DigestInit_ex(md, EVP_md5(), NULL);
    EVP_DigestUpdate(md, passwd, passwd_len);
    EVP_DigestUpdate(md, "$", 1);
    EVP_DigestUpdate(md, magic, strlen(magic));
    EVP_DigestUpdate(md, "$", 1);
    EVP_DigestUpdate(md, salt_out, salt_len);
    md2 = EVP_MD_CTX_new();
    if (md2 == NULL)
        return NULL;
    EVP_DigestInit_ex(md2, EVP_md5(), NULL);
    EVP_DigestUpdate(md2, passwd, passwd_len);
    EVP_DigestUpdate(md2, salt_out, salt_len);
    EVP_DigestUpdate(md2, passwd, passwd_len);
    EVP_DigestFinal_ex(md2, buf, NULL);
    for (i = passwd_len; i > sizeof buf; i -= sizeof buf)
        EVP_DigestUpdate(md, buf, sizeof buf);
    EVP_DigestUpdate(md, buf, i);
    n = passwd_len;
    while (n) {
        EVP_DigestUpdate(md, (n & 1) ? "\0" : passwd, 1);
        n >>= 1;
    }
    EVP_DigestFinal_ex(md, buf, NULL);
    for (i = 0; i < 1000; i++) {
        EVP_DigestInit_ex(md2, EVP_md5(), NULL);
        EVP_DigestUpdate(md2, (i & 1) ? (unsigned const char *)passwd : buf,
                         (i & 1) ? passwd_len : sizeof buf);
        if (i % 3)
            EVP_DigestUpdate(md2, salt_out, salt_len);
        if (i % 7)
            EVP_DigestUpdate(md2, passwd, passwd_len);
        EVP_DigestUpdate(md2, (i & 1) ? buf : (unsigned const char *)passwd,
                         (i & 1) ? sizeof buf : passwd_len);
        EVP_DigestFinal_ex(md2, buf, NULL);
    }
    EVP_MD_CTX_free(md2);
    EVP_MD_CTX_free(md);
    {
        unsigned char buf_perm[sizeof buf];
        int dest, source;
        char *output;
        for (dest = 0, source = 0; dest < 14;
             dest++, source = (source + 6) % 17)
            buf_perm[dest] = buf[source];
        buf_perm[14] = buf[5];
        buf_perm[15] = buf[11];
#  ifndef PEDANTIC
        assert(16 == sizeof buf_perm);
#  endif
        output = salt_out + salt_len;
        assert(output == out_buf + strlen(out_buf));
        *output++ = '$';
        for (i = 0; i < 15; i += 3) {
            *output++ = cov_2char[buf_perm[i + 2] & 0x3f];
            *output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) |
                                  (buf_perm[i + 2] >> 6)];
            *output++ = cov_2char[((buf_perm[i] & 3) << 4) |
                                  (buf_perm[i + 1] >> 4)];
            *output++ = cov_2char[buf_perm[i] >> 2];
        }
        assert(i == 15);
        *output++ = cov_2char[buf_perm[i] & 0x3f];
        *output++ = cov_2char[buf_perm[i] >> 6];
        *output = 0;
        assert(strlen(out_buf) < sizeof(out_buf));
    }
    return out_buf;
}
['static char *md5crypt(const char *passwd, const char *magic, const char *salt)\n{\n    static char out_buf[6 + 9 + 24 + 2];\n    unsigned char buf[MD5_DIGEST_LENGTH];\n    char *salt_out;\n    int n;\n    unsigned int i;\n    EVP_MD_CTX *md, *md2;\n    size_t passwd_len, salt_len;\n    passwd_len = strlen(passwd);\n    out_buf[0] = \'$\';\n    out_buf[1] = 0;\n    assert(strlen(magic) <= 4);\n    OPENSSL_strlcat(out_buf, magic, sizeof out_buf);\n    OPENSSL_strlcat(out_buf, "$", sizeof out_buf);\n    OPENSSL_strlcat(out_buf, salt, sizeof out_buf);\n    assert(strlen(out_buf) <= 6 + 8);\n    salt_out = out_buf + 2 + strlen(magic);\n    salt_len = strlen(salt_out);\n    assert(salt_len <= 8);\n    md = EVP_MD_CTX_new();\n    if (md == NULL)\n        return NULL;\n    EVP_DigestInit_ex(md, EVP_md5(), NULL);\n    EVP_DigestUpdate(md, passwd, passwd_len);\n    EVP_DigestUpdate(md, "$", 1);\n    EVP_DigestUpdate(md, magic, strlen(magic));\n    EVP_DigestUpdate(md, "$", 1);\n    EVP_DigestUpdate(md, salt_out, salt_len);\n    md2 = EVP_MD_CTX_new();\n    if (md2 == NULL)\n        return NULL;\n    EVP_DigestInit_ex(md2, EVP_md5(), NULL);\n    EVP_DigestUpdate(md2, passwd, passwd_len);\n    EVP_DigestUpdate(md2, salt_out, salt_len);\n    EVP_DigestUpdate(md2, passwd, passwd_len);\n    EVP_DigestFinal_ex(md2, buf, NULL);\n    for (i = passwd_len; i > sizeof buf; i -= sizeof buf)\n        EVP_DigestUpdate(md, buf, sizeof buf);\n    EVP_DigestUpdate(md, buf, i);\n    n = passwd_len;\n    while (n) {\n        EVP_DigestUpdate(md, (n & 1) ? "\\0" : passwd, 1);\n        n >>= 1;\n    }\n    EVP_DigestFinal_ex(md, buf, NULL);\n    for (i = 0; i < 1000; i++) {\n        EVP_DigestInit_ex(md2, EVP_md5(), NULL);\n        EVP_DigestUpdate(md2, (i & 1) ? (unsigned const char *)passwd : buf,\n                         (i & 1) ? passwd_len : sizeof buf);\n        if (i % 3)\n            EVP_DigestUpdate(md2, salt_out, salt_len);\n        if (i % 7)\n            EVP_DigestUpdate(md2, passwd, passwd_len);\n        EVP_DigestUpdate(md2, (i & 1) ? buf : (unsigned const char *)passwd,\n                         (i & 1) ? sizeof buf : passwd_len);\n        EVP_DigestFinal_ex(md2, buf, NULL);\n    }\n    EVP_MD_CTX_free(md2);\n    EVP_MD_CTX_free(md);\n    {\n        unsigned char buf_perm[sizeof buf];\n        int dest, source;\n        char *output;\n        for (dest = 0, source = 0; dest < 14;\n             dest++, source = (source + 6) % 17)\n            buf_perm[dest] = buf[source];\n        buf_perm[14] = buf[5];\n        buf_perm[15] = buf[11];\n#  ifndef PEDANTIC\n        assert(16 == sizeof buf_perm);\n#  endif\n        output = salt_out + salt_len;\n        assert(output == out_buf + strlen(out_buf));\n        *output++ = \'$\';\n        for (i = 0; i < 15; i += 3) {\n            *output++ = cov_2char[buf_perm[i + 2] & 0x3f];\n            *output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) |\n                                  (buf_perm[i + 2] >> 6)];\n            *output++ = cov_2char[((buf_perm[i] & 3) << 4) |\n                                  (buf_perm[i + 1] >> 4)];\n            *output++ = cov_2char[buf_perm[i] >> 2];\n        }\n        assert(i == 15);\n        *output++ = cov_2char[buf_perm[i] & 0x3f];\n        *output++ = cov_2char[buf_perm[i] >> 6];\n        *output = 0;\n        assert(strlen(out_buf) < sizeof(out_buf));\n    }\n    return out_buf;\n}']