apps/passwd.c:369: error: BUFFER_OVERRUN_L2
  Offset: [0, 16] Size: 16.
Showing all 5 steps of the trace


apps/passwd.c:368:18: <Offset trace>
366.   
367.   		/* silly output permutation */
368.   		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
                        ^
369.   			buf_perm[dest] = buf[source];
370.   		buf_perm[14] = buf[5];

apps/passwd.c:368:18: Assignment
366.   
367.   		/* silly output permutation */
368.   		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
                        ^
369.   			buf_perm[dest] = buf[source];
370.   		buf_perm[14] = buf[5];

apps/passwd.c:295:1: <Length trace>
293.    * I've ever encountered.)
294.    */
295. > static char *md5crypt(const char *passwd, const char *magic, const char *salt)
296.   	{
297.   	static char out_buf[6 + 9 + 24 + 2]; /* "$apr1$..salt..$.......md5hash..........\0" */

apps/passwd.c:295:1: Array declaration
293.    * I've ever encountered.)
294.    */
295. > static char *md5crypt(const char *passwd, const char *magic, const char *salt)
296.   	{
297.   	static char out_buf[6 + 9 + 24 + 2]; /* "$apr1$..salt..$.......md5hash..........\0" */

apps/passwd.c:369:21: Array access: Offset: [0, 16] Size: 16
367.   		/* silly output permutation */
368.   		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
369.   			buf_perm[dest] = buf[source];
                           ^
370.   		buf_perm[14] = buf[5];
371.   		buf_perm[15] = buf[11];

static char *md5crypt(const char *passwd, const char *magic, const char *salt)
	{
	static char out_buf[6 + 9 + 24 + 2];
	unsigned char buf[MD5_DIGEST_LENGTH];
	char *salt_out;
	int n, i;
	MD5_CTX md;
	size_t passwd_len, salt_len;
	passwd_len = strlen(passwd);
	out_buf[0] = '$';
	out_buf[1] = 0;
	assert(strlen(magic) <= 4);
	strncat(out_buf, magic, 4);
	strncat(out_buf, "$", 1);
	strncat(out_buf, salt, 8);
	assert(strlen(out_buf) <= 6 + 8);
	salt_out = out_buf + 6;
	salt_len = strlen(salt_out);
	assert(salt_len <= 8);
	MD5_Init(&md);
	MD5_Update(&md, passwd, passwd_len);
	MD5_Update(&md, "$", 1);
	MD5_Update(&md, magic, strlen(magic));
	MD5_Update(&md, "$", 1);
	MD5_Update(&md, salt_out, salt_len);
	 {
		MD5_CTX md2;
		MD5_Init(&md2);
		MD5_Update(&md2, passwd, passwd_len);
		MD5_Update(&md2, salt_out, salt_len);
		MD5_Update(&md2, passwd, passwd_len);
		MD5_Final(buf, &md2);
	 }
	for (i = passwd_len; i > sizeof buf; i -= sizeof buf)
		MD5_Update(&md, buf, sizeof buf);
	MD5_Update(&md, buf, i);
	n = passwd_len;
	while (n)
		{
		MD5_Update(&md, (n & 1) ? "\0" : passwd, 1);
		n >>= 1;
		}
	MD5_Final(buf, &md);
	for (i = 0; i < 1000; i++)
		{
		MD5_CTX md2;
		MD5_Init(&md2);
		MD5_Update(&md2, (i & 1) ? (unsigned char *) passwd : buf,
		                 (i & 1) ? passwd_len : sizeof buf);
		if (i % 3)
			MD5_Update(&md2, salt_out, salt_len);
		if (i % 7)
			MD5_Update(&md2, passwd, passwd_len);
		MD5_Update(&md2, (i & 1) ? buf : (unsigned char *) passwd,
		                 (i & 1) ? sizeof buf : passwd_len);
		MD5_Final(buf, &md2);
		}
	 {
		unsigned char buf_perm[sizeof buf];
		int dest, source;
		char *output;
		for (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)
			buf_perm[dest] = buf[source];
		buf_perm[14] = buf[5];
		buf_perm[15] = buf[11];
#ifndef PEDANTIC
		assert(16 == sizeof buf_perm);
#endif
		output = salt_out + salt_len;
		assert(output == out_buf + strlen(out_buf));
		*output++ = '$';
		for (i = 0; i < 15; i += 3)
			{
			*output++ = cov_2char[buf_perm[i+2] & 0x3f];
			*output++ = cov_2char[((buf_perm[i+1] & 0xf) << 2) |
				                  (buf_perm[i+2] >> 6)];
			*output++ = cov_2char[((buf_perm[i] & 3) << 4) |
				                  (buf_perm[i+1] >> 4)];
			*output++ = cov_2char[buf_perm[i] >> 2];
			}
		assert(i == 15);
		*output++ = cov_2char[buf_perm[i] & 0x3f];
		*output++ = cov_2char[buf_perm[i] >> 6];
		*output = 0;
		assert(strlen(out_buf) < sizeof(out_buf));
	 }
	return out_buf;
	}
['static char *md5crypt(const char *passwd, const char *magic, const char *salt)\n\t{\n\tstatic char out_buf[6 + 9 + 24 + 2];\n\tunsigned char buf[MD5_DIGEST_LENGTH];\n\tchar *salt_out;\n\tint n, i;\n\tMD5_CTX md;\n\tsize_t passwd_len, salt_len;\n\tpasswd_len = strlen(passwd);\n\tout_buf[0] = \'$\';\n\tout_buf[1] = 0;\n\tassert(strlen(magic) <= 4);\n\tstrncat(out_buf, magic, 4);\n\tstrncat(out_buf, "$", 1);\n\tstrncat(out_buf, salt, 8);\n\tassert(strlen(out_buf) <= 6 + 8);\n\tsalt_out = out_buf + 6;\n\tsalt_len = strlen(salt_out);\n\tassert(salt_len <= 8);\n\tMD5_Init(&md);\n\tMD5_Update(&md, passwd, passwd_len);\n\tMD5_Update(&md, "$", 1);\n\tMD5_Update(&md, magic, strlen(magic));\n\tMD5_Update(&md, "$", 1);\n\tMD5_Update(&md, salt_out, salt_len);\n\t {\n\t\tMD5_CTX md2;\n\t\tMD5_Init(&md2);\n\t\tMD5_Update(&md2, passwd, passwd_len);\n\t\tMD5_Update(&md2, salt_out, salt_len);\n\t\tMD5_Update(&md2, passwd, passwd_len);\n\t\tMD5_Final(buf, &md2);\n\t }\n\tfor (i = passwd_len; i > sizeof buf; i -= sizeof buf)\n\t\tMD5_Update(&md, buf, sizeof buf);\n\tMD5_Update(&md, buf, i);\n\tn = passwd_len;\n\twhile (n)\n\t\t{\n\t\tMD5_Update(&md, (n & 1) ? "\\0" : passwd, 1);\n\t\tn >>= 1;\n\t\t}\n\tMD5_Final(buf, &md);\n\tfor (i = 0; i < 1000; i++)\n\t\t{\n\t\tMD5_CTX md2;\n\t\tMD5_Init(&md2);\n\t\tMD5_Update(&md2, (i & 1) ? (unsigned char *) passwd : buf,\n\t\t                 (i & 1) ? passwd_len : sizeof buf);\n\t\tif (i % 3)\n\t\t\tMD5_Update(&md2, salt_out, salt_len);\n\t\tif (i % 7)\n\t\t\tMD5_Update(&md2, passwd, passwd_len);\n\t\tMD5_Update(&md2, (i & 1) ? buf : (unsigned char *) passwd,\n\t\t                 (i & 1) ? sizeof buf : passwd_len);\n\t\tMD5_Final(buf, &md2);\n\t\t}\n\t {\n\t\tunsigned char buf_perm[sizeof buf];\n\t\tint dest, source;\n\t\tchar *output;\n\t\tfor (dest = 0, source = 0; dest < 14; dest++, source = (source + 6) % 17)\n\t\t\tbuf_perm[dest] = buf[source];\n\t\tbuf_perm[14] = buf[5];\n\t\tbuf_perm[15] = buf[11];\n#ifndef PEDANTIC\n\t\tassert(16 == sizeof buf_perm);\n#endif\n\t\toutput = salt_out + salt_len;\n\t\tassert(output == out_buf + strlen(out_buf));\n\t\t*output++ = \'$\';\n\t\tfor (i = 0; i < 15; i += 3)\n\t\t\t{\n\t\t\t*output++ = cov_2char[buf_perm[i+2] & 0x3f];\n\t\t\t*output++ = cov_2char[((buf_perm[i+1] & 0xf) << 2) |\n\t\t\t\t                  (buf_perm[i+2] >> 6)];\n\t\t\t*output++ = cov_2char[((buf_perm[i] & 3) << 4) |\n\t\t\t\t                  (buf_perm[i+1] >> 4)];\n\t\t\t*output++ = cov_2char[buf_perm[i] >> 2];\n\t\t\t}\n\t\tassert(i == 15);\n\t\t*output++ = cov_2char[buf_perm[i] & 0x3f];\n\t\t*output++ = cov_2char[buf_perm[i] >> 6];\n\t\t*output = 0;\n\t\tassert(strlen(out_buf) < sizeof(out_buf));\n\t }\n\treturn out_buf;\n\t}']