jcs.org
slock with DPMS and other tweaks
fix CVE-2016-6866
+8
-2
+8
-2
slock.c
+8
-2
slock.c
···
123
123
readpw(Display *dpy, const char *pws)
124
124
#endif
125
125
{
126
-
char buf[32], passwd[256];
126
+
char buf[32], passwd[256], *encrypted;
127
127
int num, screen;
128
128
unsigned int len, color;
129
129
KeySym ksym;
···
159
159
#ifdef HAVE_BSD_AUTH
160
160
running = !auth_userokay(getlogin(), NULL, "auth-slock", passwd);
161
161
#else
162
-
running = !!strcmp(crypt(passwd, pws), pws);
162
+
errno = 0;
163
+
if (!(encrypted = crypt(passwd, pws)))
164
+
fprintf(stderr, "slock: crypt: %s\n", strerror(errno));
165
+
else
166
+
running = !!strcmp(encrypted, pws);
163
167
#endif
164
168
if (running) {
165
169
XBell(dpy, 100);
···
312
316
313
317
#ifndef HAVE_BSD_AUTH
314
318
pws = getpw();
319
+
if (strlen(pws) < 2)
320
+
die("slock: failed to get user password hash.\n");
315
321
#endif
316
322
317
323
if (!(dpy = XOpenDisplay(NULL)))