apps/passwd.c:807: error: BUFFER_OVERRUN_L3
  Offset: [0, 16] Size: [1, 17].
Showing all 5 steps of the trace


apps/passwd.c:784:9: <Offset trace>
782.       /* first make sure we have a salt */
783.       if (!passed_salt) {
784.           size_t saltlen = 0;
               ^
785.           size_t i;
786.   

apps/passwd.c:784:9: Assignment
782.       /* first make sure we have a salt */
783.       if (!passed_salt) {
784.           size_t saltlen = 0;
               ^
785.           size_t i;
786.   

apps/passwd.c:773:1: <Length trace>
771.   }
772.   
773. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
774.                        char *passwd, BIO *out, int quiet, int table,
775.                        int reverse, size_t pw_maxlen, passwd_modes mode)

apps/passwd.c:773:1: Parameter `**salt_p`
771.   }
772.   
773. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
774.                        char *passwd, BIO *out, int quiet, int table,
775.                        int reverse, size_t pw_maxlen, passwd_modes mode)

apps/passwd.c:807:9: Array access: Offset: [0, 16] Size: [1, 17]
805.           for (i = 0; i < saltlen; i++)
806.               (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */
807.           (*salt_p)[i] = 0;
               ^
808.   # ifdef CHARSET_EBCDIC
809.           /* The password encryption funtion will convert back to ASCII */

static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
                     char *passwd, BIO *out, int quiet, int table,
                     int reverse, size_t pw_maxlen, passwd_modes mode)
{
    char *hash = NULL;
    assert(salt_p != NULL);
    assert(salt_malloc_p != NULL);
    if (!passed_salt) {
        size_t saltlen = 0;
        size_t i;
#ifndef OPENSSL_NO_DES
        if (mode == passwd_crypt)
            saltlen = 2;
#endif
        if (mode == passwd_md5 || mode == passwd_apr1 || mode == passwd_aixmd5)
            saltlen = 8;
        if (mode == passwd_sha256 || mode == passwd_sha512)
            saltlen = 16;
        assert(saltlen != 0);
        if (*salt_malloc_p == NULL)
            *salt_p = *salt_malloc_p = app_malloc(saltlen + 1, "salt buffer");
        if (RAND_bytes((unsigned char *)*salt_p, saltlen) <= 0)
            goto end;
        for (i = 0; i < saltlen; i++)
            (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];
        (*salt_p)[i] = 0;
# ifdef CHARSET_EBCDIC
        ascii2ebcdic(*salt_p, *salt_p, saltlen);
# endif
    }
    assert(*salt_p != NULL);
    if ((strlen(passwd) > pw_maxlen)) {
        if (!quiet)
            BIO_printf(bio_err,
                       "Warning: truncating password to %u characters\n",
                       (unsigned)pw_maxlen);
        passwd[pw_maxlen] = 0;
    }
    assert(strlen(passwd) <= pw_maxlen);
#ifndef OPENSSL_NO_DES
    if (mode == passwd_crypt)
        hash = DES_crypt(passwd, *salt_p);
#endif
    if (mode == passwd_md5 || mode == passwd_apr1)
        hash = md5crypt(passwd, (mode == passwd_md5 ? "1" : "apr1"), *salt_p);
    if (mode == passwd_aixmd5)
        hash = md5crypt(passwd, "", *salt_p);
    if (mode == passwd_sha256 || mode == passwd_sha512)
        hash = shacrypt(passwd, (mode == passwd_sha256 ? "5" : "6"), *salt_p);
    assert(hash != NULL);
    if (table && !reverse)
        BIO_printf(out, "%s\t%s\n", passwd, hash);
    else if (table && reverse)
        BIO_printf(out, "%s\t%s\n", hash, passwd);
    else
        BIO_printf(out, "%s\n", hash);
    return 1;
 end:
    return 0;
}
['static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,\n                     char *passwd, BIO *out, int quiet, int table,\n                     int reverse, size_t pw_maxlen, passwd_modes mode)\n{\n    char *hash = NULL;\n    assert(salt_p != NULL);\n    assert(salt_malloc_p != NULL);\n    if (!passed_salt) {\n        size_t saltlen = 0;\n        size_t i;\n#ifndef OPENSSL_NO_DES\n        if (mode == passwd_crypt)\n            saltlen = 2;\n#endif\n        if (mode == passwd_md5 || mode == passwd_apr1 || mode == passwd_aixmd5)\n            saltlen = 8;\n        if (mode == passwd_sha256 || mode == passwd_sha512)\n            saltlen = 16;\n        assert(saltlen != 0);\n        if (*salt_malloc_p == NULL)\n            *salt_p = *salt_malloc_p = app_malloc(saltlen + 1, "salt buffer");\n        if (RAND_bytes((unsigned char *)*salt_p, saltlen) <= 0)\n            goto end;\n        for (i = 0; i < saltlen; i++)\n            (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];\n        (*salt_p)[i] = 0;\n# ifdef CHARSET_EBCDIC\n        ascii2ebcdic(*salt_p, *salt_p, saltlen);\n# endif\n    }\n    assert(*salt_p != NULL);\n    if ((strlen(passwd) > pw_maxlen)) {\n        if (!quiet)\n            BIO_printf(bio_err,\n                       "Warning: truncating password to %u characters\\n",\n                       (unsigned)pw_maxlen);\n        passwd[pw_maxlen] = 0;\n    }\n    assert(strlen(passwd) <= pw_maxlen);\n#ifndef OPENSSL_NO_DES\n    if (mode == passwd_crypt)\n        hash = DES_crypt(passwd, *salt_p);\n#endif\n    if (mode == passwd_md5 || mode == passwd_apr1)\n        hash = md5crypt(passwd, (mode == passwd_md5 ? "1" : "apr1"), *salt_p);\n    if (mode == passwd_aixmd5)\n        hash = md5crypt(passwd, "", *salt_p);\n    if (mode == passwd_sha256 || mode == passwd_sha512)\n        hash = shacrypt(passwd, (mode == passwd_sha256 ? "5" : "6"), *salt_p);\n    assert(hash != NULL);\n    if (table && !reverse)\n        BIO_printf(out, "%s\\t%s\\n", passwd, hash);\n    else if (table && reverse)\n        BIO_printf(out, "%s\\t%s\\n", hash, passwd);\n    else\n        BIO_printf(out, "%s\\n", hash);\n    return 1;\n end:\n    return 0;\n}']