On Wed, Oct 28, 2026 at 10:22:00AM +0100, Dirk-Wilhelm Peters wrote:
> I have just found out by accident that xlock leaves its door slightly
> ajar when using the marquee mode with a custom message:
>
> xlock -mode marquee -message "hack me"
>
> Simply type a few random characters to get back in.
>
> Abort trap
>
> This worked on several amd64 machines running 8.0 and 8.0-current.
>
This is a undefined behaviour of memcpy() on overlapping buffers. This
patch should fix it.
None of the non default modes of xlock have been seriously audited for
bugs like that. We still recommend to stick to -mode blank (the
default).
Index: modes/marquee.c
===================================================================
RCS file: /local/cvs/xenocara/app/xlockmore/modes/marquee.c,v
diff -u -p -u -r1.1.1.1 marquee.c
--- modes/marquee.c 26 Nov 2006 11:08:32 -0000 1.1.1.1
+++ modes/marquee.c 28 Oct 2026 11:12:10 -0000
@@ -269,7 +269,7 @@ add_blanks(marqueestruct * mp)
mp->x -= 2 * char_width[(int) (' ')];
if (mp->x <= -char_width[(int) (unsigned char) mp->modwords[0]]) {
mp->x += char_width[(int) (unsigned char) mp->modwords[0]];
- (void) memcpy(mp->modwords, &(mp->modwords[1]), mp->nonblanks);
+ (void) memmove(mp->modwords, &(mp->modwords[1]), mp->nonblanks);
mp->nonblanks--;
}
return (mp->nonblanks < 0);
@@ -287,7 +287,7 @@ add_letter(marqueestruct * mp, char lett
mp->x -= char_width[(int) letter];
if (mp->x <= -char_width[(int) (unsigned char) mp->modwords[0]]) {
mp->x += char_width[(int) (unsigned char) mp->modwords[0]];
- (void) memcpy(mp->modwords, &(mp->modwords[1]), mp->t);
+ (void) memmove(mp->modwords, &(mp->modwords[1]), mp->t);
mp->modwords[mp->t] = ' ';
mp->t--;
} else
--
Matthieu Herrb
