apps/passwd.c:453: error: BUFFER_OVERRUN_L3
  Offset: 8 Size: [3, 9].
Showing all 3 steps of the trace


apps/passwd.c:412:1: <Length trace>
410.   # endif
411.   
412. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
413.                        char *passwd, BIO *out, int quiet, int table,
414.                        int reverse, size_t pw_maxlen, int usecrypt, int use1,

apps/passwd.c:412:1: Parameter `**salt_p`
410.   # endif
411.   
412. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
413.                        char *passwd, BIO *out, int quiet, int table,
414.                        int reverse, size_t pw_maxlen, int usecrypt, int use1,

apps/passwd.c:453:13: Array access: Offset: 8 Size: [3, 9]
451.               for (i = 0; i < 8; i++)
452.                   (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f]; /* 6 bits */
453.               (*salt_p)[8] = 0;
                   ^
454.           }
455.   # endif                         /* !NO_MD5CRYPT_1 */

static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
                     char *passwd, BIO *out, int quiet, int table,
                     int reverse, size_t pw_maxlen, int usecrypt, int use1,
                     int useapr1)
{
    char *hash = NULL;
    assert(salt_p != NULL);
    assert(salt_malloc_p != NULL);
    if (!passed_salt) {
# ifndef OPENSSL_NO_DES
        if (usecrypt) {
            if (*salt_malloc_p == NULL) {
                *salt_p = *salt_malloc_p = app_malloc(3, "salt buffer");
            }
            if (RAND_bytes((unsigned char *)*salt_p, 2) <= 0)
                goto end;
            (*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f];
            (*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f];
            (*salt_p)[2] = 0;
#  ifdef CHARSET_EBCDIC
            ascii2ebcdic(*salt_p, *salt_p, 2);
#  endif
        }
# endif
# ifndef NO_MD5CRYPT_1
        if (use1 || useapr1) {
            int i;
            if (*salt_malloc_p == NULL) {
                *salt_p = *salt_malloc_p = app_malloc(9, "salt buffer");
            }
            if (RAND_bytes((unsigned char *)*salt_p, 8) <= 0)
                goto end;
            for (i = 0; i < 8; i++)
                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];
            (*salt_p)[8] = 0;
        }
# endif
    }
    assert(*salt_p != NULL);
    if ((strlen(passwd) > pw_maxlen)) {
        if (!quiet)
            BIO_printf(bio_err,
                       "Warning: truncating password to %u characters\n",
                       (unsigned)pw_maxlen);
        passwd[pw_maxlen] = 0;
    }
    assert(strlen(passwd) <= pw_maxlen);
# ifndef OPENSSL_NO_DES
    if (usecrypt)
        hash = DES_crypt(passwd, *salt_p);
# endif
# ifndef NO_MD5CRYPT_1
    if (use1 || useapr1)
        hash = md5crypt(passwd, (use1 ? "1" : "apr1"), *salt_p);
# endif
    assert(hash != NULL);
    if (table && !reverse)
        BIO_printf(out, "%s\t%s\n", passwd, hash);
    else if (table && reverse)
        BIO_printf(out, "%s\t%s\n", hash, passwd);
    else
        BIO_printf(out, "%s\n", hash);
    return 0;
 end:
    return 1;
}
['static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,\n                     char *passwd, BIO *out, int quiet, int table,\n                     int reverse, size_t pw_maxlen, int usecrypt, int use1,\n                     int useapr1)\n{\n    char *hash = NULL;\n    assert(salt_p != NULL);\n    assert(salt_malloc_p != NULL);\n    if (!passed_salt) {\n# ifndef OPENSSL_NO_DES\n        if (usecrypt) {\n            if (*salt_malloc_p == NULL) {\n                *salt_p = *salt_malloc_p = app_malloc(3, "salt buffer");\n            }\n            if (RAND_bytes((unsigned char *)*salt_p, 2) <= 0)\n                goto end;\n            (*salt_p)[0] = cov_2char[(*salt_p)[0] & 0x3f];\n            (*salt_p)[1] = cov_2char[(*salt_p)[1] & 0x3f];\n            (*salt_p)[2] = 0;\n#  ifdef CHARSET_EBCDIC\n            ascii2ebcdic(*salt_p, *salt_p, 2);\n#  endif\n        }\n# endif\n# ifndef NO_MD5CRYPT_1\n        if (use1 || useapr1) {\n            int i;\n            if (*salt_malloc_p == NULL) {\n                *salt_p = *salt_malloc_p = app_malloc(9, "salt buffer");\n            }\n            if (RAND_bytes((unsigned char *)*salt_p, 8) <= 0)\n                goto end;\n            for (i = 0; i < 8; i++)\n                (*salt_p)[i] = cov_2char[(*salt_p)[i] & 0x3f];\n            (*salt_p)[8] = 0;\n        }\n# endif\n    }\n    assert(*salt_p != NULL);\n    if ((strlen(passwd) > pw_maxlen)) {\n        if (!quiet)\n            BIO_printf(bio_err,\n                       "Warning: truncating password to %u characters\\n",\n                       (unsigned)pw_maxlen);\n        passwd[pw_maxlen] = 0;\n    }\n    assert(strlen(passwd) <= pw_maxlen);\n# ifndef OPENSSL_NO_DES\n    if (usecrypt)\n        hash = DES_crypt(passwd, *salt_p);\n# endif\n# ifndef NO_MD5CRYPT_1\n    if (use1 || useapr1)\n        hash = md5crypt(passwd, (use1 ? "1" : "apr1"), *salt_p);\n# endif\n    assert(hash != NULL);\n    if (table && !reverse)\n        BIO_printf(out, "%s\\t%s\\n", passwd, hash);\n    else if (table && reverse)\n        BIO_printf(out, "%s\\t%s\\n", hash, passwd);\n    else\n        BIO_printf(out, "%s\\n", hash);\n    return 0;\n end:\n    return 1;\n}']