apps/passwd.c:385: error: BUFFER_OVERRUN_L2
  Offset: [0, 16] Size: 16.
Showing all 5 steps of the trace


apps/passwd.c:384:18: <Offset trace>
382.   
383.   		/* silly output permutation */
384.   		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
                        ^
385.   			buf_perm[dest] = buf[source];
386.   		buf_perm[14] = buf[5];

apps/passwd.c:384:18: Assignment
382.   
383.   		/* silly output permutation */
384.   		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
                        ^
385.   			buf_perm[dest] = buf[source];
386.   		buf_perm[14] = buf[5];

apps/passwd.c:311:1: <Length trace>
309.    * I've ever encountered.)
310.    */
311. > static char *md5crypt(const char *passwd, const char *magic, const char *salt)
312.   	{
313.   	/* "$apr1$..salt..$.......md5hash..........\0" */

apps/passwd.c:311:1: Array declaration
309.    * I've ever encountered.)
310.    */
311. > static char *md5crypt(const char *passwd, const char *magic, const char *salt)
312.   	{
313.   	/* "$apr1$..salt..$.......md5hash..........\0" */

apps/passwd.c:385:21: Array access: Offset: [0, 16] Size: 16
383.   		/* silly output permutation */
384.   		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
385.   			buf_perm[dest] = buf[source];
                           ^
386.   		buf_perm[14] = buf[5];
387.   		buf_perm[15] = buf[11];

static char *md5crypt(const char *passwd, const char *magic, const char *salt)
	{
	static char out_buf[6 + 9 + 24 + 2];
	unsigned char buf[MD5_DIGEST_LENGTH];
	char *salt_out;
	int n;
	unsigned int i;
	EVP_MD_CTX md,md2;
	size_t passwd_len, salt_len;
	passwd_len = strlen(passwd);
	out_buf[0] = '$';
	out_buf[1] = 0;
	assert(strlen(magic) <= 4);
	strncat(out_buf, magic, 4);
	strncat(out_buf, "$", 1);
	strncat(out_buf, salt, 8);
	assert(strlen(out_buf) <= 6 + 8);
	salt_out = out_buf + 2 + strlen(magic);
	salt_len = strlen(salt_out);
	assert(salt_len <= 8);
	EVP_MD_CTX_init(&md);
	EVP_DigestInit_ex(&md,EVP_md5(), NULL);
	EVP_DigestUpdate(&md, passwd, passwd_len);
	EVP_DigestUpdate(&md, "$", 1);
	EVP_DigestUpdate(&md, magic, strlen(magic));
	EVP_DigestUpdate(&md, "$", 1);
	EVP_DigestUpdate(&md, salt_out, salt_len);
	EVP_MD_CTX_init(&md2);
	EVP_DigestInit_ex(&md2,EVP_md5(), NULL);
	EVP_DigestUpdate(&md2, passwd, passwd_len);
	EVP_DigestUpdate(&md2, salt_out, salt_len);
	EVP_DigestUpdate(&md2, passwd, passwd_len);
	EVP_DigestFinal_ex(&md2, buf, NULL);
	for (i = passwd_len; i > sizeof buf; i -= sizeof buf)
		EVP_DigestUpdate(&md, buf, sizeof buf);
	EVP_DigestUpdate(&md, buf, i);
	n = passwd_len;
	while (n)
		{
		EVP_DigestUpdate(&md, (n & 1) ? "\0" : passwd, 1);
		n >>= 1;
		}
	EVP_DigestFinal_ex(&md, buf, NULL);
	for (i = 0; i < 1000; i++)
		{
		EVP_DigestInit_ex(&md2,EVP_md5(), NULL);
		EVP_DigestUpdate(&md2, (i & 1) ? (unsigned const char *) passwd : buf,
		                       (i & 1) ? passwd_len : sizeof buf);
		if (i % 3)
			EVP_DigestUpdate(&md2, salt_out, salt_len);
		if (i % 7)
			EVP_DigestUpdate(&md2, passwd, passwd_len);
		EVP_DigestUpdate(&md2, (i & 1) ? buf : (unsigned const char *) passwd,
		                       (i & 1) ? sizeof buf : passwd_len);
		EVP_DigestFinal_ex(&md2, buf, NULL);
		}
	EVP_MD_CTX_cleanup(&md2);
	 {
		unsigned char buf_perm[sizeof buf];
		int dest, source;
		char *output;
		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
			buf_perm[dest] = buf[source];
		buf_perm[14] = buf[5];
		buf_perm[15] = buf[11];
#ifndef PEDANTIC
		assert(16 == sizeof buf_perm);
#endif
		output = salt_out + salt_len;
		assert(output == out_buf + strlen(out_buf));
		*output++ = '$';
		for (i = 0; i < 15; i += 3)
			{
			*output++ = cov_2char[buf_perm[i+2] & 0x3f];
			*output++ = cov_2char[((buf_perm[i+1] & 0xf) << 2) |
				                  (buf_perm[i+2] >> 6)];
			*output++ = cov_2char[((buf_perm[i] & 3) << 4) |
				                  (buf_perm[i+1] >> 4)];
			*output++ = cov_2char[buf_perm[i] >> 2];
			}
		assert(i == 15);
		*output++ = cov_2char[buf_perm[i] & 0x3f];
		*output++ = cov_2char[buf_perm[i] >> 6];
		*output = 0;
		assert(strlen(out_buf) < sizeof(out_buf));
	 }
	EVP_MD_CTX_cleanup(&md);
	return out_buf;
	}
['static char *md5crypt(const char *passwd, const char *magic, const char *salt)\n\t{\n\tstatic char out_buf[6 + 9 + 24 + 2];\n\tunsigned char buf[MD5_DIGEST_LENGTH];\n\tchar *salt_out;\n\tint n;\n\tunsigned int i;\n\tEVP_MD_CTX md,md2;\n\tsize_t passwd_len, salt_len;\n\tpasswd_len = strlen(passwd);\n\tout_buf[0] = \'$\';\n\tout_buf[1] = 0;\n\tassert(strlen(magic) <= 4);\n\tstrncat(out_buf, magic, 4);\n\tstrncat(out_buf, "$", 1);\n\tstrncat(out_buf, salt, 8);\n\tassert(strlen(out_buf) <= 6 + 8);\n\tsalt_out = out_buf + 2 + strlen(magic);\n\tsalt_len = strlen(salt_out);\n\tassert(salt_len <= 8);\n\tEVP_MD_CTX_init(&md);\n\tEVP_DigestInit_ex(&md,EVP_md5(), NULL);\n\tEVP_DigestUpdate(&md, passwd, passwd_len);\n\tEVP_DigestUpdate(&md, "$", 1);\n\tEVP_DigestUpdate(&md, magic, strlen(magic));\n\tEVP_DigestUpdate(&md, "$", 1);\n\tEVP_DigestUpdate(&md, salt_out, salt_len);\n\tEVP_MD_CTX_init(&md2);\n\tEVP_DigestInit_ex(&md2,EVP_md5(), NULL);\n\tEVP_DigestUpdate(&md2, passwd, passwd_len);\n\tEVP_DigestUpdate(&md2, salt_out, salt_len);\n\tEVP_DigestUpdate(&md2, passwd, passwd_len);\n\tEVP_DigestFinal_ex(&md2, buf, NULL);\n\tfor (i = passwd_len; i > sizeof buf; i -= sizeof buf)\n\t\tEVP_DigestUpdate(&md, buf, sizeof buf);\n\tEVP_DigestUpdate(&md, buf, i);\n\tn = passwd_len;\n\twhile (n)\n\t\t{\n\t\tEVP_DigestUpdate(&md, (n & 1) ? "\\0" : passwd, 1);\n\t\tn >>= 1;\n\t\t}\n\tEVP_DigestFinal_ex(&md, buf, NULL);\n\tfor (i = 0; i < 1000; i++)\n\t\t{\n\t\tEVP_DigestInit_ex(&md2,EVP_md5(), NULL);\n\t\tEVP_DigestUpdate(&md2, (i & 1) ? (unsigned const char *) passwd : buf,\n\t\t                       (i & 1) ? passwd_len : sizeof buf);\n\t\tif (i % 3)\n\t\t\tEVP_DigestUpdate(&md2, salt_out, salt_len);\n\t\tif (i % 7)\n\t\t\tEVP_DigestUpdate(&md2, passwd, passwd_len);\n\t\tEVP_DigestUpdate(&md2, (i & 1) ? buf : (unsigned const char *) passwd,\n\t\t                       (i & 1) ? sizeof buf : passwd_len);\n\t\tEVP_DigestFinal_ex(&md2, buf, NULL);\n\t\t}\n\tEVP_MD_CTX_cleanup(&md2);\n\t {\n\t\tunsigned char buf_perm[sizeof buf];\n\t\tint dest, source;\n\t\tchar *output;\n\t\tfor (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)\n\t\t\tbuf_perm[dest] = buf[source];\n\t\tbuf_perm[14] = buf[5];\n\t\tbuf_perm[15] = buf[11];\n#ifndef PEDANTIC\n\t\tassert(16 == sizeof buf_perm);\n#endif\n\t\toutput = salt_out + salt_len;\n\t\tassert(output == out_buf + strlen(out_buf));\n\t\t*output++ = \'$\';\n\t\tfor (i = 0; i < 15; i += 3)\n\t\t\t{\n\t\t\t*output++ = cov_2char[buf_perm[i+2] & 0x3f];\n\t\t\t*output++ = cov_2char[((buf_perm[i+1] & 0xf) << 2) |\n\t\t\t\t                  (buf_perm[i+2] >> 6)];\n\t\t\t*output++ = cov_2char[((buf_perm[i] & 3) << 4) |\n\t\t\t\t                  (buf_perm[i+1] >> 4)];\n\t\t\t*output++ = cov_2char[buf_perm[i] >> 2];\n\t\t\t}\n\t\tassert(i == 15);\n\t\t*output++ = cov_2char[buf_perm[i] & 0x3f];\n\t\t*output++ = cov_2char[buf_perm[i] >> 6];\n\t\t*output = 0;\n\t\tassert(strlen(out_buf) < sizeof(out_buf));\n\t }\n\tEVP_MD_CTX_cleanup(&md);\n\treturn out_buf;\n\t}']