fixed a potential buffer overflow bug on the stack (thanks to Ghassan Misherg)

[slock.git] / slock.c

diff --git a/slock.c b/slock.c
index 62fcac9..94cb26b 100644 (file)
--- a/slock.c
+++ b/slock.c
@@ -1,4 +1,4 @@
-/* (C)opyright MMIV-MMV Anselm R. Garbe <garbeam at gmail dot com>
+/* (C)opyright MMVI-MMVII Anselm R. Garbe <garbeam at gmail dot com>

  * See LICENSE file for license details.
  */
 #define _XOPEN_SOURCE 500
  * See LICENSE file for license details.
  */
 #define _XOPEN_SOURCE 500


@@ -102,7 +102,7 @@ main(int argc, char **argv) {
        while(running && !XNextEvent(dpy, &ev))
                if(ev.type == KeyPress) {
                        buf[0] = 0;
        while(running && !XNextEvent(dpy, &ev))
                if(ev.type == KeyPress) {
                        buf[0] = 0;

-                       num = XLookupString(&ev.xkey, buf, sizeof(buf), &ksym, 0);
+                       num = XLookupString(&ev.xkey, buf, sizeof buf, &ksym, 0);

                        if(IsFunctionKey(ksym) || IsKeypadKey(ksym)
                                        || IsMiscFunctionKey(ksym) || IsPFKey(ksym)
                                        || IsPrivateKeypadKey(ksym))
                        if(IsFunctionKey(ksym) || IsKeypadKey(ksym)
                                        || IsMiscFunctionKey(ksym) || IsPFKey(ksym)
                                        || IsPrivateKeypadKey(ksym))


@@ -122,7 +122,7 @@ main(int argc, char **argv) {
                                        --len;
                                break;
                        default:
                                        --len;
                                break;
                        default:

-                               if(num && !iscntrl((int) buf[0])) {
+                               if(num && !iscntrl((int) buf[0]) && (len + num < sizeof passwd)) { 

                                        memcpy(passwd + len, buf, num);
                                        len += num;
                                }
                                        memcpy(passwd + len, buf, num);
                                        len += num;
                                }