i3 / i3lock

improved screen locker
https://i3wm.org/i3lock
BSD 3-Clause "New" or "Revised" License
921 stars 404 forks source link

Scrambled passwords during STATE_AUTH_WRONG #191

Closed layus closed 6 years ago

layus commented 6 years ago

Hi,

Typing too fast has a strange undefined behavior in the AUTH_WRONG state. This happens often to me as I type my password fairly quickly but, for some reason, I tend to make many mistakes.

When in AUTH_WRONG state, hitting enter (or any validation key) sets retry_verification = true; https://github.com/i3/i3lock/blob/ad680b40192f665dd7af4d62ab6996318e275cb6/i3lock.c#L435 If more characters are typed after that, they are added after the validated password, making it useless when verification is retried.

For example, with a password set to abcd. Typing "xxxx\nabcd\nab" within two seconds will

  1. validate "xxxx" as a password attempt and fail. i3lock enters the AUTH_WRONG state and further attempts are locked for two seconds
  2. "abcd" will be added to the password buffer
  3. enter will set retry_verification to true.
  4. "ab" will be added to the password buffer
  5. after the two seconds delay, "abcdab" will be considered the next password attempt, and fail.

This can go on for some time, as the logical continuation is to type "cd\n", which will obviously spoil the next attempt, and so on.

I would suggest to either

  1. keep the last submitted password for retry_verification and keep extra characters in a separate buffer.
  2. discard the previously submitted password if extra characters are entered after submitting a password (see #192).