Follow on from CVE-2014-3571. This fixes the code that was the original source

[oweals/openssl.git] / apps / passwd.c

diff --git a/apps/passwd.c b/apps/passwd.c
index 6965c6e0902a49f4985fa85a120f286e0a86889b..8e65ed7cbb976a53f36dee28a6492aa4abf5f33d 100644 (file)
--- a/apps/passwd.c
+++ b/apps/passwd.c
@@ -43,7 +43,8 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
        char *passwd, BIO *out, int quiet, int table, int reverse,
        size_t pw_maxlen, int usecrypt, int use1, int useapr1);
 
-/* -crypt        - standard Unix password algorithm (default)
+/*-
+ * -crypt        - standard Unix password algorithm (default)
  * -1            - MD5-based password algorithm
  * -apr1         - MD5-based password algorithm, Apache variant
  * -salt string  - salt
@@ -474,7 +475,8 @@ static int do_passwd(int passed_salt, char **salt_p, char **salt_malloc_p,
        if ((strlen(passwd) > pw_maxlen))
                {
                if (!quiet)
-                       BIO_printf(bio_err, "Warning: truncating password to %u characters\n", pw_maxlen);
+                       /* XXX: really we should know how to print a size_t, not cast it */
+                       BIO_printf(bio_err, "Warning: truncating password to %u characters\n", (unsigned)pw_maxlen);
                passwd[pw_maxlen] = 0;
                }
        assert(strlen(passwd) <= pw_maxlen);