From 6e1da9135134daaf9c90dc84013ee5001e6a9005 Mon Sep 17 00:00:00 2001
From: Toby Murray <toby.murray@unimelb.edu.au>
Date: Mon, 9 Sep 2019 15:32:38 +1000
Subject: [PATCH] secure password input -- but not storage
---
src/passbook.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/src/passbook.c b/src/passbook.c
index b7cb845..0d5c7bf 100644
--- a/src/passbook.c
+++ b/src/passbook.c
@@ -2,6 +2,8 @@
#include <string.h>
#include <stdlib.h>
#include <assert.h>
+#include <pwd.h>
+#include <unistd.h>
#include "debug.h"
@@ -472,16 +474,13 @@ static int execute(void){
if (numToks != 2){
return -1;
}
- printf("Enter master password: ");
- char * res = fgets(pwbuf,sizeof(pwbuf),stdin);
- char * pwtoks[1];
- const unsigned int numPWToks = tokenise(pwbuf,pwtoks,1);
- if (res == NULL || numPWToks != 1 || strcmp(pwtoks[0],toks[1]) != 0){
- fprintf(stderr,"Master password incorrect! Exiting immediately.\n");
+ const char * pass = getpass("Enter master password: ");
+ if (pass == NULL || strcmp(pass,toks[1]) != 0){
+ fprintf(stderr,"Master password incorrect!\n");
#ifdef PASSBOOK_FUZZ // actually don't exit but keep going when fuzzing
return -1;
#else
- exit(1);
+ exit(1); // exit immediately
#endif
}
--
GitLab