apps/passwd.c:839: error: BUFFER_OVERRUN_L3
  Offset added: [-31, +oo] (⇐ [0, +oo] + [-31, 64]) Size: [1, +oo] by call to `shacrypt`.
Showing all 8 steps of the trace


apps/passwd.c:773:1: Parameter `pw_maxlen`
771.   }
772.   
773. > static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
774.                        char *passwd, BIO *out, int quiet, int table,
775.                        int reverse, size_t pw_maxlen, passwd_modes mode)

apps/passwd.c:839:16: Call
837.           hash = md5crypt(passwd, "", *salt_p);
838.       if (mode == passwd_sha256 || mode == passwd_sha512)
839.           hash = shacrypt(passwd, (mode == passwd_sha256 ? "5" : "6"), *salt_p);
                      ^
840.       assert(hash != NULL);
841.   

apps/passwd.c:533:9: <Offset trace>
531.       case '5':
532.           sha = EVP_sha256();
533.           buf_size = 32;
               ^
534.           break;
535.       case '6':

apps/passwd.c:533:9: Assignment
  531.       case '5':
  532.           sha = EVP_sha256();
  533.           buf_size = 32;
                 ^
  534.           break;
  535.       case '6':

apps/passwd.c:533:9: <Length trace>
531.       case '5':
532.           sha = EVP_sha256();
533.           buf_size = 32;
               ^
534.           break;
535.       case '6':

apps/passwd.c:533:9: Assignment
  531.       case '5':
  532.           sha = EVP_sha256();
  533.           buf_size = 32;
                 ^
  534.           break;
  535.       case '6':

apps/passwd.c:650:69: Assignment
  648.       if ((p_bytes = OPENSSL_zalloc(passwd_len)) == NULL)
  649.           goto err;
  650.       for (cp = p_bytes, n = passwd_len; n > buf_size; n -= buf_size, cp += buf_size)
                                                                             ^
  651.           memcpy(cp, temp_buf, buf_size);
  652.       memcpy(cp, temp_buf, n);

apps/passwd.c:652:5: Array access: Offset added: [-31, +oo] (⇐ [0, +oo] + [-31, 64]) Size: [1, +oo] by call to `shacrypt` 
  650.       for (cp = p_bytes, n = passwd_len; n > buf_size; n -= buf_size, cp += buf_size)
  651.           memcpy(cp, temp_buf, buf_size);
  652.       memcpy(cp, temp_buf, n);
             ^
  653.   
  654.       /* S sequence */
