In password callback, added check for password > max size. Also added null terminator.