apps/passwd.c:367: error: BUFFER_OVERRUN_L2
  Offset: [0, 16] Size: 16.
Showing all 5 steps of the trace


apps/passwd.c:365:24: <Offset trace>
363.   
364.           /* silly output permutation */
365.           for (dest = 0, source = 0; dest < 14;
                              ^
366.                dest++, source = (source + 6) % 17)
367.               buf_perm[dest] = buf[source];

apps/passwd.c:365:24: Assignment
363.   
364.           /* silly output permutation */
365.           for (dest = 0, source = 0; dest < 14;
                              ^
366.                dest++, source = (source + 6) % 17)
367.               buf_perm[dest] = buf[source];

apps/passwd.c:294:1: <Length trace>
292.    * application of the NIH principle I've ever encountered.)
293.    */
294. > static char *md5crypt(const char *passwd, const char *magic, const char *salt)
295.   {
296.       /* "$apr1$..salt..$.......md5hash..........\0" */

apps/passwd.c:294:1: Array declaration
292.    * application of the NIH principle I've ever encountered.)
293.    */
294. > static char *md5crypt(const char *passwd, const char *magic, const char *salt)
295.   {
296.       /* "$apr1$..salt..$.......md5hash..........\0" */

apps/passwd.c:367:30: Array access: Offset: [0, 16] Size: 16
365.           for (dest = 0, source = 0; dest < 14;
366.                dest++, source = (source + 6) % 17)
367.               buf_perm[dest] = buf[source];
                                    ^
368.           buf_perm[14] = buf[5];
369.           buf_perm[15] = buf[11];

static char *md5crypt(const char *passwd, const char *magic, const char *salt)
{
    static char out_buf[6 + 9 + 24 + 2];
    unsigned char buf[MD5_DIGEST_LENGTH];
    char *salt_out;
    int n;
    unsigned int i;
    EVP_MD_CTX md, md2;
    size_t passwd_len, salt_len;
    passwd_len = strlen(passwd);
    out_buf[0] = '$';
    out_buf[1] = 0;
    assert(strlen(magic) <= 4);
    strncat(out_buf, magic, 4);
    strncat(out_buf, "$", 1);
    strncat(out_buf, salt, 8);
    assert(strlen(out_buf) <= 6 + 8);
    salt_out = out_buf + 2 + strlen(magic);
    salt_len = strlen(salt_out);
    assert(salt_len <= 8);
    EVP_MD_CTX_init(&md);
    EVP_DigestInit_ex(&md, EVP_md5(), NULL);
    EVP_DigestUpdate(&md, passwd, passwd_len);
    EVP_DigestUpdate(&md, "$", 1);
    EVP_DigestUpdate(&md, magic, strlen(magic));
    EVP_DigestUpdate(&md, "$", 1);
    EVP_DigestUpdate(&md, salt_out, salt_len);
    EVP_MD_CTX_init(&md2);
    EVP_DigestInit_ex(&md2, EVP_md5(), NULL);
    EVP_DigestUpdate(&md2, passwd, passwd_len);
    EVP_DigestUpdate(&md2, salt_out, salt_len);
    EVP_DigestUpdate(&md2, passwd, passwd_len);
    EVP_DigestFinal_ex(&md2, buf, NULL);
    for (i = passwd_len; i > sizeof buf; i -= sizeof buf)
        EVP_DigestUpdate(&md, buf, sizeof buf);
    EVP_DigestUpdate(&md, buf, i);
    n = passwd_len;
    while (n) {
        EVP_DigestUpdate(&md, (n & 1) ? "\0" : passwd, 1);
        n >>= 1;
    }
    EVP_DigestFinal_ex(&md, buf, NULL);
    for (i = 0; i < 1000; i++) {
        EVP_DigestInit_ex(&md2, EVP_md5(), NULL);
        EVP_DigestUpdate(&md2, (i & 1) ? (unsigned const char *)passwd : buf,
                         (i & 1) ? passwd_len : sizeof buf);
        if (i % 3)
            EVP_DigestUpdate(&md2, salt_out, salt_len);
        if (i % 7)
            EVP_DigestUpdate(&md2, passwd, passwd_len);
        EVP_DigestUpdate(&md2, (i & 1) ? buf : (unsigned const char *)passwd,
                         (i & 1) ? sizeof buf : passwd_len);
        EVP_DigestFinal_ex(&md2, buf, NULL);
    }
    EVP_MD_CTX_cleanup(&md2);
    {
        unsigned char buf_perm[sizeof buf];
        int dest, source;
        char *output;
        for (dest = 0, source = 0; dest < 14;
             dest++, source = (source + 6) % 17)
            buf_perm[dest] = buf[source];
        buf_perm[14] = buf[5];
        buf_perm[15] = buf[11];
#  ifndef PEDANTIC
        assert(16 == sizeof buf_perm);
#  endif
        output = salt_out + salt_len;
        assert(output == out_buf + strlen(out_buf));
        *output++ = '$';
        for (i = 0; i < 15; i += 3) {
            *output++ = cov_2char[buf_perm[i + 2] & 0x3f];
            *output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) |
                                  (buf_perm[i + 2] >> 6)];
            *output++ = cov_2char[((buf_perm[i] & 3) << 4) |
                                  (buf_perm[i + 1] >> 4)];
            *output++ = cov_2char[buf_perm[i] >> 2];
        }
        assert(i == 15);
        *output++ = cov_2char[buf_perm[i] & 0x3f];
        *output++ = cov_2char[buf_perm[i] >> 6];
        *output = 0;
        assert(strlen(out_buf) < sizeof(out_buf));
    }
    EVP_MD_CTX_cleanup(&md);
    return out_buf;
}
['static char *md5crypt(const char *passwd, const char *magic, const char *salt)\n{\n    static char out_buf[6 + 9 + 24 + 2];\n    unsigned char buf[MD5_DIGEST_LENGTH];\n    char *salt_out;\n    int n;\n    unsigned int i;\n    EVP_MD_CTX md, md2;\n    size_t passwd_len, salt_len;\n    passwd_len = strlen(passwd);\n    out_buf[0] = \'$\';\n    out_buf[1] = 0;\n    assert(strlen(magic) <= 4);\n    strncat(out_buf, magic, 4);\n    strncat(out_buf, "$", 1);\n    strncat(out_buf, salt, 8);\n    assert(strlen(out_buf) <= 6 + 8);\n    salt_out = out_buf + 2 + strlen(magic);\n    salt_len = strlen(salt_out);\n    assert(salt_len <= 8);\n    EVP_MD_CTX_init(&md);\n    EVP_DigestInit_ex(&md, EVP_md5(), NULL);\n    EVP_DigestUpdate(&md, passwd, passwd_len);\n    EVP_DigestUpdate(&md, "$", 1);\n    EVP_DigestUpdate(&md, magic, strlen(magic));\n    EVP_DigestUpdate(&md, "$", 1);\n    EVP_DigestUpdate(&md, salt_out, salt_len);\n    EVP_MD_CTX_init(&md2);\n    EVP_DigestInit_ex(&md2, EVP_md5(), NULL);\n    EVP_DigestUpdate(&md2, passwd, passwd_len);\n    EVP_DigestUpdate(&md2, salt_out, salt_len);\n    EVP_DigestUpdate(&md2, passwd, passwd_len);\n    EVP_DigestFinal_ex(&md2, buf, NULL);\n    for (i = passwd_len; i > sizeof buf; i -= sizeof buf)\n        EVP_DigestUpdate(&md, buf, sizeof buf);\n    EVP_DigestUpdate(&md, buf, i);\n    n = passwd_len;\n    while (n) {\n        EVP_DigestUpdate(&md, (n & 1) ? "\\0" : passwd, 1);\n        n >>= 1;\n    }\n    EVP_DigestFinal_ex(&md, buf, NULL);\n    for (i = 0; i < 1000; i++) {\n        EVP_DigestInit_ex(&md2, EVP_md5(), NULL);\n        EVP_DigestUpdate(&md2, (i & 1) ? (unsigned const char *)passwd : buf,\n                         (i & 1) ? passwd_len : sizeof buf);\n        if (i % 3)\n            EVP_DigestUpdate(&md2, salt_out, salt_len);\n        if (i % 7)\n            EVP_DigestUpdate(&md2, passwd, passwd_len);\n        EVP_DigestUpdate(&md2, (i & 1) ? buf : (unsigned const char *)passwd,\n                         (i & 1) ? sizeof buf : passwd_len);\n        EVP_DigestFinal_ex(&md2, buf, NULL);\n    }\n    EVP_MD_CTX_cleanup(&md2);\n    {\n        unsigned char buf_perm[sizeof buf];\n        int dest, source;\n        char *output;\n        for (dest = 0, source = 0; dest < 14;\n             dest++, source = (source + 6) % 17)\n            buf_perm[dest] = buf[source];\n        buf_perm[14] = buf[5];\n        buf_perm[15] = buf[11];\n#  ifndef PEDANTIC\n        assert(16 == sizeof buf_perm);\n#  endif\n        output = salt_out + salt_len;\n        assert(output == out_buf + strlen(out_buf));\n        *output++ = \'$\';\n        for (i = 0; i < 15; i += 3) {\n            *output++ = cov_2char[buf_perm[i + 2] & 0x3f];\n            *output++ = cov_2char[((buf_perm[i + 1] & 0xf) << 2) |\n                                  (buf_perm[i + 2] >> 6)];\n            *output++ = cov_2char[((buf_perm[i] & 3) << 4) |\n                                  (buf_perm[i + 1] >> 4)];\n            *output++ = cov_2char[buf_perm[i] >> 2];\n        }\n        assert(i == 15);\n        *output++ = cov_2char[buf_perm[i] & 0x3f];\n        *output++ = cov_2char[buf_perm[i] >> 6];\n        *output = 0;\n        assert(strlen(out_buf) < sizeof(out_buf));\n    }\n    EVP_MD_CTX_cleanup(&md);\n    return out_buf;\n}']