slock

commit 55d985a354048e14f408dd731faaf1acbdc277f4
parent 3791a996e230aec59d61faea46634ae4f031e359
Author: Leonardo Taccari <leot@NetBSD.org>
Date:   Mon, 27 Jul 2026 23:27:43 +0200

Avoid ctype(3) abuses

Valid argument of ctype(3) functions must be either EOF or non-negative
value within the range representable as unsigned char. Invalid values
leads to undefined behavior.

Cast all such uses to avoid that.

At least in NetBSD 11 ctype(3) abuses will always crash and permit
to break slock screen locking.

Diffstat:
M
slock.c
 | 
2
+-

1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/slock.c b/slock.c
@@ -181,7 +181,7 @@ readpw(Display *dpy, struct xrandr *rr, struct lock **locks, int nscreens,
 					passwd[--len] = '\0';
 				break;
 			default:
-				if (num && !iscntrl((int)buf[0]) &&
+				if (num && !iscntrl((unsigned char)buf[0]) &&
 				    (len + num < sizeof(passwd))) {
 					memcpy(passwd + len, buf, num);
 					len += num;