apps/passwd.c:247: error: BUFFER_OVERRUN_L3
  Offset: 8 Size: [3, 9] by call to `do_passwd`.
Showing all 5 steps of the trace


apps/passwd.c:118:5: Assignment
116.   {
117.       BIO *in = NULL;
118.       char *infile = NULL, *salt = NULL, *passwd = NULL, **passwds = NULL;
           ^
119.       char *salt_malloc = NULL, *passwd_malloc = NULL, *prog;
120.       OPTION_CHOICE o;

apps/passwd.c:247:18: Call
245.           do {                    /* loop over list of passwords */
246.               passwd = *passwds++;
247.               if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, bio_out,
                        ^
248.                              quiet, table, reverse, pw_maxlen, usecrypt, use1,
249.                              useapr1))

apps/passwd.c:412:1: <Length trace>
410.   # endif
411.   
412. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
413.                        char *passwd, BIO *out, int quiet, int table,
414.                        int reverse, size_t pw_maxlen, int usecrypt, int use1,

apps/passwd.c:412:1: Parameter `**salt_p`
  410.   # endif
  411.   
  412. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
  413.                        char *passwd, BIO *out, int quiet, int table,
  414.                        int reverse, size_t pw_maxlen, int usecrypt, int use1,

apps/passwd.c:453:13: Array access: Offset: 8 Size: [3, 9] by call to `do_passwd` 
  451.               for (i = 0; i < 8; i++)
  452.                   (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */
  453.               (*salt_p)[8] = 0;
                     ^
  454.           }
  455.   # endif                         /* !NO_MD5CRYPT_1 */

static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
                     char *passwd, BIO *out, int quiet, int table,
                     int reverse, size_t pw_maxlen, int usecrypt, int use1,
                     int useapr1)
{
    char *hash = NULL;
    assert(salt_p != NULL);
    assert(salt_malloc_p != NULL);
    if (!passed_salt) {
# ifndef OPENSSL_NO_DES
        if (usecrypt) {
            if (*salt_malloc_p == NULL) {
                *salt_p = *salt_malloc_p = app_malloc(3, "salt buffer");
            }
            if (RAND_bytes((unsigned char *)*salt_p, 2) <= 0)
                goto end;
            (*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f];
            (*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f];
            (*salt_p)[2] = 0;
#  ifdef CHARSET_EBCDIC
            ascii2ebcdic(*salt_p, *salt_p, 2);
#  endif
        }
# endif
# ifndef NO_MD5CRYPT_1
        if (use1 || useapr1) {
            int i;
            if (*salt_malloc_p == NULL) {
                *salt_p = *salt_malloc_p = app_malloc(9, "salt buffer");
            }
            if (RAND_bytes((unsigned char *)*salt_p, 8) <= 0)
                goto end;
            for (i = 0; i < 8; i++)
                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];
            (*salt_p)[8] = 0;
        }
# endif
    }
    assert(*salt_p != NULL);
    if ((strlen(passwd) > pw_maxlen)) {
        if (!quiet)
            BIO_printf(bio_err,
                       "Warning: truncating password to %u characters\n",
                       (unsigned)pw_maxlen);
        passwd[pw_maxlen] = 0;
    }
    assert(strlen(passwd) <= pw_maxlen);
# ifndef OPENSSL_NO_DES
    if (usecrypt)
        hash = DES_crypt(passwd, *salt_p);
# endif
# ifndef NO_MD5CRYPT_1
    if (use1 || useapr1)
        hash = md5crypt(passwd, (use1 ? "1" : "apr1"), *salt_p);
# endif
    assert(hash != NULL);
    if (table && !reverse)
        BIO_printf(out, "%s\t%s\n", passwd, hash);
    else if (table && reverse)
        BIO_printf(out, "%s\t%s\n", hash, passwd);
    else
        BIO_printf(out, "%s\n", hash);
    return 0;
 end:
    return 1;
}
['int passwd_main(int argc, char **argv)\n{\n    BIO *in = NULL;\n    char *infile = NULL, *salt = NULL, *passwd = NULL, **passwds = NULL;\n    char *salt_malloc = NULL, *passwd_malloc = NULL, *prog;\n    OPTION_CHOICE o;\n    int in_stdin = 0, in_noverify = 0, pw_source_defined = 0;\n    int passed_salt = 0, quiet = 0, table = 0, reverse = 0;\n    int ret = 1, usecrypt = 0, use1 = 0, useapr1 = 0;\n    size_t passwd_malloc_size = 0, pw_maxlen = 256;\n    prog = opt_init(argc, argv, passwd_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            opt_help(passwd_options);\n            ret = 0;\n            goto end;\n        case OPT_IN:\n            if (pw_source_defined)\n                goto opthelp;\n            infile = opt_arg();\n            pw_source_defined = 1;\n            break;\n        case OPT_NOVERIFY:\n            in_noverify = 1;\n            break;\n        case OPT_QUIET:\n            quiet = 1;\n            break;\n        case OPT_TABLE:\n            table = 1;\n            break;\n        case OPT_REVERSE:\n            reverse = 1;\n            break;\n        case OPT_1:\n            use1 = 1;\n            break;\n        case OPT_APR1:\n            useapr1 = 1;\n            break;\n        case OPT_CRYPT:\n            usecrypt = 1;\n            break;\n        case OPT_SALT:\n            passed_salt = 1;\n            salt = opt_arg();\n            break;\n        case OPT_STDIN:\n            if (pw_source_defined)\n                goto opthelp;\n            in_stdin = 1;\n            break;\n        }\n    }\n    argc = opt_num_rest();\n    argv = opt_rest();\n    if (*argv) {\n        if (pw_source_defined)\n            goto opthelp;\n        pw_source_defined = 1;\n        passwds = argv;\n    }\n    if (!usecrypt && !use1 && !useapr1) {\n        usecrypt = 1;\n    }\n    if (usecrypt + use1 + useapr1 > 1) {\n        goto opthelp;\n    }\n# ifdef OPENSSL_NO_DES\n    if (usecrypt)\n        goto opthelp;\n# endif\n# ifdef NO_MD5CRYPT_1\n    if (use1 || useapr1)\n        goto opthelp;\n# endif\n    if (infile && in_stdin) {\n        BIO_printf(bio_err, "%s: Can\'t combine -in and -stdin\\n", prog);\n        goto end;\n    }\n    in = bio_open_default(infile, \'r\', FORMAT_TEXT);\n    if (in == NULL)\n        goto end;\n    if (usecrypt)\n        pw_maxlen = 8;\n    else if (use1 || useapr1)\n        pw_maxlen = 256;\n    if (passwds == NULL) {\n        passwd_malloc_size = pw_maxlen + 2;\n        passwd = passwd_malloc =\n            app_malloc(passwd_malloc_size, "password buffer");\n    }\n    if ((in == NULL) && (passwds == NULL)) {\n        static char *passwds_static[2] = { NULL, NULL };\n        passwds = passwds_static;\n        if (in == NULL)\n            if (EVP_read_pw_string\n                (passwd_malloc, passwd_malloc_size, "Password: ",\n                 !(passed_salt || in_noverify)) != 0)\n                goto end;\n        passwds[0] = passwd_malloc;\n    }\n    if (in == NULL) {\n        assert(passwds != NULL);\n        assert(*passwds != NULL);\n        do {\n            passwd = *passwds++;\n            if (!do_passwd(passed_salt, &salt, &salt_malloc, passwd, bio_out,\n                           quiet, table, reverse, pw_maxlen, usecrypt, use1,\n                           useapr1))\n                goto end;\n        }\n        while (*passwds != NULL);\n    } else\n    {\n        int done;\n        assert(passwd != NULL);\n        do {\n            int r = BIO_gets(in, passwd, pw_maxlen + 1);\n            if (r > 0) {\n                char *c = (strchr(passwd, \'\\n\'));\n                if (c != NULL)\n                    *c = 0;\n                else {\n                    char trash[BUFSIZ];\n                    do\n                        r = BIO_gets(in, trash, sizeof trash);\n                    while ((r > 0) && (!strchr(trash, \'\\n\')));\n                }\n                if (!do_passwd\n                    (passed_salt, &salt, &salt_malloc, passwd, bio_out, quiet,\n                     table, reverse, pw_maxlen, usecrypt, use1, useapr1))\n                    goto end;\n            }\n            done = (r <= 0);\n        }\n        while (!done);\n    }\n    ret = 0;\n end:\n    ERR_print_errors(bio_err);\n    OPENSSL_free(salt_malloc);\n    OPENSSL_free(passwd_malloc);\n    BIO_free(in);\n    return (ret);\n}', 'static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,\n                     char *passwd, BIO *out, int quiet, int table,\n                     int reverse, size_t pw_maxlen, int usecrypt, int use1,\n                     int useapr1)\n{\n    char *hash = NULL;\n    assert(salt_p != NULL);\n    assert(salt_malloc_p != NULL);\n    if (!passed_salt) {\n# ifndef OPENSSL_NO_DES\n        if (usecrypt) {\n            if (*salt_malloc_p == NULL) {\n                *salt_p = *salt_malloc_p = app_malloc(3, "salt buffer");\n            }\n            if (RAND_bytes((unsigned char *)*salt_p, 2) <= 0)\n                goto end;\n            (*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f];\n            (*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f];\n            (*salt_p)[2] = 0;\n#  ifdef CHARSET_EBCDIC\n            ascii2ebcdic(*salt_p, *salt_p, 2);\n#  endif\n        }\n# endif\n# ifndef NO_MD5CRYPT_1\n        if (use1 || useapr1) {\n            int i;\n            if (*salt_malloc_p == NULL) {\n                *salt_p = *salt_malloc_p = app_malloc(9, "salt buffer");\n            }\n            if (RAND_bytes((unsigned char *)*salt_p, 8) <= 0)\n                goto end;\n            for (i = 0; i < 8; i++)\n                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];\n            (*salt_p)[8] = 0;\n        }\n# endif\n    }\n    assert(*salt_p != NULL);\n    if ((strlen(passwd) > pw_maxlen)) {\n        if (!quiet)\n            BIO_printf(bio_err,\n                       "Warning: truncating password to %u characters\\n",\n                       (unsigned)pw_maxlen);\n        passwd[pw_maxlen] = 0;\n    }\n    assert(strlen(passwd) <= pw_maxlen);\n# ifndef OPENSSL_NO_DES\n    if (usecrypt)\n        hash = DES_crypt(passwd, *salt_p);\n# endif\n# ifndef NO_MD5CRYPT_1\n    if (use1 || useapr1)\n        hash = md5crypt(passwd, (use1 ? "1" : "apr1"), *salt_p);\n# endif\n    assert(hash != NULL);\n    if (table && !reverse)\n        BIO_printf(out, "%s\\t%s\\n", passwd, hash);\n    else if (table && reverse)\n        BIO_printf(out, "%s\\t%s\\n", hash, passwd);\n    else\n        BIO_printf(out, "%s\\n", hash);\n    return 0;\n end:\n    return 1;\n}']