malloc problems

[garion]

I have made a function to check the user's password but I got a strange error when trying to run it:
*** glibc detected *** malloc(): memory corruption: 0x0805b280 ***
Aborted

here is the function:

int auth_passwd(const char *user, const char *password)
{
	char *sys_pass, *user_pass, *salt;
	struct spwd *sp;

	sp=getspnam(user);
	sys_pass=strdup(sp->sp_pwdp);

	if(sys_pass==NULL) return -1;

	if(!strncmp(sys_pass, "$1", 2)) {
		/* the password is encrypted with MD5 algorithm */
		if((salt=malloc(12))==NULL) {
			perror("malloc");
			exit(1);
		}
		strncpy(salt, sys_pass, 11);
		salt[12]='\0';
	} else {
		/* the password is encrypted with DES algorithm */
		if((salt=malloc(3))==NULL) {
			perror("malloc");
			exit(1);
		}
		strncpy(salt, sys_pass, 2);
		salt[3]='\0';
	}

	user_pass=(char *)crypt(password, salt);

	if(!strcmp(sys_pass, user_pass)) {
		xfree(salt);
		return=1;
	} else {
		xfree(salt);
		result -1;
	}
}

Can you tell me where is the problem ?

[Salem]

> if((salt=malloc(12))==NULL) {
> salt[12]='\0';
You stepped off the end of your allocation.

And why are you calling xfree() when you called malloc().
It should be free()

[garion]

my fault, xfree(); is a function just like free(); but with error checking. Sorry, I forgot to edit that one.
Thank you for the help, eventhough that was a stupid mistake

[Slacker]

>eventhough that was a stupid mistake
I haven't encountered a smart mistake, have you?

[dwks]

return=1;

Is that supposed to be like this?

return 1;

[edit]
And this? What does it do?

result -1;

[/edit]

[dwks]

You also accessed memory outside your allocated space here:

		if((salt=malloc(3))==NULL) {
			perror("malloc");
			exit(1);
		}
		strncpy(salt, sys_pass, 2);
		salt[3]='\0';

It's just like an array. If you allocate 3 bytes, the last addressable element is [2].