strcpy(rest, hash + 5) -> strncpy?

[AlexanderKurtz]

https://github.com/skx/pam_pwnd/blob/6abe1caac275e289987384677ec9d7fec1bba827/pwn_chk.c#L54

It might be a good idea to replace this with strncpy() since the was_leaked() function never checks the string length of hash.

[skx]

That's a good catch, thank-you for reading the code so carefully.

• I've used strncpy instead of strcpy.
• I've added a length-check on the input to the function too, to prevent too-short, as well as too-long.
  • i.e. If the input was "foo" then +5 would be invalid.