used invalid sha size (64 bytes) with 32 malloc'd buffer