htpasswd: don't point to (unused) stack memory on output
to make static analysers happy.  PR 60634.
Reported by shqking and Zhenwei Zou.
@@ -75,15 +75,20 @@ static int mkrecord(struct passwd_ctx *ctx, char *user)
{
char hash_str[MAX_STRING_LEN];
int ret;
+
ctx->out = hash_str;
ctx->out_len = sizeof(hash_str);
ret = mkhash(ctx);
- if (ret)
+ if (ret) {
+ ctx->out = NULL;
+ ctx->out_len = 0;
return ret;
+ }
ctx->out = apr_pstrcat(ctx->pool, user, ":", hash_str, NL, NULL);
- if (strlen(ctx->out) >= MAX_STRING_LEN) {
+ ctx->out_len = strlen(ctx->out);
+ if (ctx->out_len >= MAX_STRING_LEN) {
ctx->errstr = "resultant record too long";
return ERR_OVERFLOW;
}
