That is a cumbersome way to do it. Have your friend look at getpwent, setpwent and friends. User::pwent is in the standard distribution, and preferred to the core functions.

That said, is it a typo in line 16 that PASSWD lacks the diamond operator? The symptoms you describe suggest that reading fails, unchecked, followed by truncate. That is reckless.

After Compline,
Zaxo