c - printf("%s") prints an additional # - c

Question

I am right know working on the cs50 programming tutorial. Here I should crack a DES-encrypted string.
First I concentrate on the creating a 64bit big array with all possible chars used in the salt.
In the next step, I throw this into two for loops to print out all possible combinations of those two for loops. And that's where I am at right now.
For debug reasons, I did just print it out with printf("%s",salt). Salt is defined as char salt[2]. But for some reason, it always prints out xx# (xx changes every time as expected, I have no idea where the # is coming from).
First I thought it might overshoot the array for some weird reason and grab the # from random memory. This is why I copied it from my online IDE into my local XCode. Still the same # symbol. And now I am confused from where the # is coming from.
Link to my code.
#include <cs50.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#define _XOPEN_SOURCE // DES - implementation
#include <unistd.h>
// shorthands
#define cypher argv[1]
#define ascii_dot 46
#define ascii_slash 47
#define ascii_zero 48
#define ascii_nine 57
#define salt_size 64
#define majA 65
#define majZ 90
#define minA 97
#define minZ 122
int main(int argc, string argv[]) {
// Checking input
if (argc != 2) {
printf("<usage>\n<./crack <password_hash>");
return 1;
}
// Create a salter
// 2 * 26 for letters + 10 for numbers + dot and slash = 64 = salt_size
char salt_crystal[salt_size];
{ // Own scope to not waste space for salt_iterator
int salt_iterator = 0; // used to create salt crystals
//minuscels
for (int i = minA; i <= minZ; i++)
salt_crystal[salt_iterator++] = (char)i;
//majuscels
for (int i = majA; i <= majZ; i++)
salt_crystal[salt_iterator++] = (char)i;
//ascii_dot to 9
for (int i = ascii_dot; i <= ascii_nine; i++)
salt_crystal[salt_iterator++] = (char) i;
}
// make the salt and forward it to the next function
for (int i = 0, l = salt_size; i < l; i++) {
char salt[2];
salt[0] = salt_crystal[i];
for (int i2 = 0, l2 = salt_size; i2 < l2; i2++) {
salt[1] = salt_crystal[i2];
printf("%s ", salt); // DEBUG
}
}
}

Answer 1

You have not posted any code, but I'm guessing you did not null terminate the array you pass to printf()...
EDIT Good guess: You set 2 characters into char salt[2] and pass that to printf. printf prints those and continues to read characters from memory beyond the end of the salt array until it finds a '\0' byte that ends the string.
There are different ways to fix this:
you can make the array longer and set a '\0' after the characters:
char salt[3];
...
salt[2] = '\0';
printf("%s", salt);
you can use a precision value of 2 in the printf format to print at most 2 bytes from the array:
printf("%.2s", salt);
you can print individual bytes from the array:
putchar(salt[0]);
putchar(salt[1]);
As to why you consistently get an #, there is no definite answer because you are experiencing undefined behavior, so anything can happen... Note however that # has value 64 which is the value you store into local variable l. It is possible that the salt array is positioned in memory juste before the l variable. In little endian, the value 64 is stored in the first byte of l.
Also note that the name l is not recommended for a variable because it is difficult to distinguish from the number 1 in a fixed font such as this.