how to manage password bug in my program in C?

Question

So what happens is, when I enter a backspace in this program, that a letter gets erased back. But if I keep pressing backspace for a longer time, -1 starts to get printed...

What is the reason for this and how can I fix this?

system("cls");

char password[25], temp;
char correctpass[10]="basket@123";
int f=0; 

label:
drawBorder(5,3,100,24);
gotoxy(40,12);
printf("Enter the password : ");

while (1) {
    temp = getch();
    if (temp == 13)
        break;
    else if(f<0){
        printf("%d",f);     
    }
    else if (temp == 8){
        printf("\b");
        printf(" ");
        printf("\b");
        f--;  
    }
    else{
        password[f] = temp;
        printf("*");
        f++;
    }
}
password[f] = '\0';

If you are intending to do anything with `correctpass`, it is likely to fail, as it is not null-terminated. And please, switch to something from this millennium, as you seem to use TurboC or something.... — Eugene Sh., Dec 24 '19 at 14:51
You write: `printf("\b"); printf(" "); printf("\b");` — you could write `printf("\b \b");` and might benefit from `fflush(stdout)` after it. — Jonathan Leffler, Dec 24 '19 at 14:56
You initialise `correctpass[10]` with an 11 byte initialiser. Did your compiler never not warn of that error?! — Clifford, Dec 24 '19 at 14:57
@Clifford: In C, it isn't an error — but it is very ill-advised. C11 [§6.7.9 Initialization ¶14](http://port70.net/~nsz/c/c11/n1570.html#6.7.9p14): _An array of character type may be initialized by a character string literal or UTF-8 string literal, optionally enclosed in braces. Successive bytes of the string literal (including the terminating null character if there is room or if the array is of unknown size) initialize the elements of the array._ . When there isn't room for the terminating null character, what is created is not a string but just a byte array (which is why it is a bad idea). — Jonathan Leffler, Dec 24 '19 at 15:01
You should also perform a check on `password` maximum length otherwise... well *funny* things will happen. — Roberto Caboni, Dec 24 '19 at 15:06
@JonathanLeffler : You think he's using C11?! It is nonetheless a _semantic error_ (i.e. was not done intentionally and does not do what the programmer intended). I am using "error" in a broader - more useful - sense than merely the language definition - not all code that compiles with defined behaviour is error free. — Clifford, Dec 24 '19 at 15:27
@Clifford — The verbiage I quote is from C11; the requirements are the same in pre-standard C, C89, C90, C94, C99, C11, C18. It's part of C. It is a bad idea; the compiler can warn about it. Under normal circumstances, it can't refuse to compile it as it is standard-conformant C code. I 100% agree that the array definition should be fixed (lose the explicit array size is simplest). But there are reasons why a compiler in default mode may not warn about that problem — especially older compilers. — Jonathan Leffler, Dec 24 '19 at 15:32
I know. I am not arguing the language definition, rather what constitutes an _error_. You have taken an unhelpfully narrow "language lawyer" view of "error". The lack of null termination that results is a semantic error (probably - since the variable is not subsequently used in this fragment, I'll concede that it may not be - but seems unlikely). — Clifford, Dec 24 '19 at 15:55
Similar question (for Linux) with answer [Hide password input on terminal](https://stackoverflow.com/questions/6856635/hide-password-input-on-terminal/32421674?r=SearchResults&s=1|47.8984#32421674) but the backspace and conditional logic to prevent backing up before the beginning of the string is the same — David C. Rankin, Dec 25 '19 at 09:19

Clifford · Answer 1 · 2019-12-25T09:06:23.473

Simply don't backspace past the beginning the password array. i.e. do not decrement f is f is already zero.

Equally, you should add a check to prevent incrementing f past the end of the password array less one character of the terminating NUL.

To support input redirection and prevent getting stuck in an endless loop, it is useful to also check for end-of-file.

    char password[25] ;
    int f = 0 ;
    int ch = 0 ;

    printf("Enter the password : ");
    for(;;)
    {
        ch  = getch();
        if( ch == EOF || ch == '\n' )
        {
            password[f] = '\0' ;
            break ; 
        }
        else if( ch == '\b' )
        {
            if( f > 0 )
            {
                printf("\b \b");
                f--;
            }
        }
        else if( f < sizeof(password) - 1 )
        {
            password[f] = ch ;
            printf( "*" ) ;
            f++;
        }
    }

how to manage password bug in my program in C?

1 Answers1