From 7ba08a4d73c1bdfd3aced09a628b1d7d7747cdca Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Fri, 4 Apr 2014 12:44:43 +0100 Subject: [PATCH] Use correct length when prompting for password. Use bufsiz - 1 not BUFSIZ - 1 when prompting for a password in the openssl utility. Thanks to Rob Mackinnon, Leviathan Security for reporting this issue. --- apps/apps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/apps.c b/apps/apps.c index b99996e944..b82882aa0c 100644 --- a/apps/apps.c +++ b/apps/apps.c @@ -588,12 +588,12 @@ int password_callback(char *buf, int bufsiz, int verify, if (ok >= 0) ok = UI_add_input_string(ui,prompt,ui_flags,buf, - PW_MIN_LENGTH,BUFSIZ-1); + PW_MIN_LENGTH,bufsiz-1); if (ok >= 0 && verify) { buff = (char *)OPENSSL_malloc(bufsiz); ok = UI_add_verify_string(ui,prompt,ui_flags,buff, - PW_MIN_LENGTH,BUFSIZ-1, buf); + PW_MIN_LENGTH,bufsiz-1, buf); } if (ok >= 0) do -- 2.25.1