bump version to 1.7

Avoid ctype(3) abuses
Valid argument of ctype(3) functions must be either EOF or non-negative value within the range representable as unsigned char. Invalid values leads to undefined behavior. Cast all such uses to avoid that. At least in NetBSD 11 ctype(3) abuses will always crash and permit to break slock screen locking.
2026-10-25 08:34:34 +00:00 · 2026-07-27 23:55:46 +02:00 · 2026-07-27 23:53:20 +02:00 · 2025-08-16 11:11:27 +02:00 · 2025-08-16 11:05:32 +02:00
2 changed files with 5 additions and 2 deletions
@@ -1,5 +1,5 @@
 # slock version
-VERSION = 1.6
+VERSION = 1.7

 # Customize below to fit your system

@@ -181,10 +181,13 @@ readpw(Display *dpy, struct xrandr *rr, struct lock **locks, int nscreens,
 					passwd[--len] = '\0';
 				break;
 			default:
-				if (num && !iscntrl((int)buf[0]) &&
+				if (num && !iscntrl((unsigned char)buf[0]) &&
 				    (len + num < sizeof(passwd))) {
 					memcpy(passwd + len, buf, num);
 					len += num;
+				} else if (buf[0] == '\025') { /* ctrl-u clears input */
+					explicit_bzero(&passwd, sizeof(passwd));
+					len = 0;
 				}
 				break;
 			}
Author	SHA1	Message	Date
Hiltjo Posthuma	b04f4d0810	bump version to 1.7	2026-07-27 23:55:46 +02:00
Leonardo Taccari	55d985a354	Avoid ctype(3) abuses Valid argument of ctype(3) functions must be either EOF or non-negative value within the range representable as unsigned char. Invalid values leads to undefined behavior. Cast all such uses to avoid that. At least in NetBSD 11 ctype(3) abuses will always crash and permit to break slock screen locking.	2026-07-27 23:53:20 +02:00
Hiltjo Posthuma	3791a996e2	add a comment for the ctrl-u clear field combo	2025-08-16 11:11:27 +02:00
Drew Marino	bf0a5577ac	Support ^U for clearing password ^U is a fairly common key combo for clearing fields, this patch adds support for it.	2025-08-16 11:05:32 +02:00