fixed a potential buffer overflow bug on the stack (thanks to Ghassan Misherg)

.hgtags

@@ -1,2 +1,3 @@
 0a95c73c7374fbc2342b6040d9f35ddf597729e1 0.1
 da5cb1f0a685258d5315ea109860bacbc2871a57 0.2
+f9157b1864388ad8f1920e5fde7c5849e73d8327 0.3

LICENSE

@@ -1,6 +1,6 @@
 MIT/X Consortium License
 
-(C)opyright MMVI Anselm R. Garbe <garbeam at gmail dot com>
+(C)opyright MMVI-MMVII Anselm R. Garbe <garbeam at gmail dot com>
 
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),

Makefile

@@ -1,5 +1,5 @@
 # slock - simple screen locker
-#   (C)opyright MMVI Anselm R. Garbe
+#   (C)opyright MMVI-MMVII Anselm R. Garbe
 
 include config.mk
 

config.mk

@@ -1,5 +1,5 @@
 # slock version
-VERSION = 0.3
+VERSION = 0.4
 
 # Customize below to fit your system
 
@@ -21,7 +21,7 @@ LDFLAGS = ${LIBS}
 #LDFLAGS = -g ${LIBS}
 
 # On *BSD remove -DHAVE_SHADOW_H from CFLAGS
-# On OpenBSD remove -lcrypt from LIBS
+# On OpenBSD and Darwin remove -lcrypt from LIBS
 
 # compiler and linker
 CC = cc

slock.c

@@ -1,4 +1,4 @@
-/* (C)opyright MMIV-MMV Anselm R. Garbe <garbeam at gmail dot com>
+/* (C)opyright MMVI-MMVII Anselm R. Garbe <garbeam at gmail dot com>
  * See LICENSE file for license details.
  */
 #define _XOPEN_SOURCE 500
@@ -102,7 +102,7 @@ main(int argc, char **argv) {
 	while(running && !XNextEvent(dpy, &ev))
 		if(ev.type == KeyPress) {
 			buf[0] = 0;
-			num = XLookupString(&ev.xkey, buf, sizeof(buf), &ksym, 0);
+			num = XLookupString(&ev.xkey, buf, sizeof buf, &ksym, 0);
 			if(IsFunctionKey(ksym) || IsKeypadKey(ksym)
 					|| IsMiscFunctionKey(ksym) || IsPFKey(ksym)
 					|| IsPrivateKeypadKey(ksym))
@@ -122,7 +122,7 @@ main(int argc, char **argv) {
 					--len;
 				break;
 			default:
-				if(num && !iscntrl((int) buf[0])) {
+				if(num && !iscntrl((int) buf[0]) && (len + num < sizeof passwd)) { 
 					memcpy(passwd + len, buf, num);
 					len += num;
 				}