Masking the characters of a password in a C program on Linux

Question

I'm trying to create a program that obscures the characters entered when entering the password. But I still have a problem, as soon as I start the program, '*' characters are continuously written up to a segmentation fault. This is the code that I wrote and the behavior of the program after execution:

#include <stdio.h>
#include <curses.h>

#define ENTER 13
#define TAB 9

char pwd[100];

int main(){
    int i = 0;
    char ch;

    printf("Enter your password. Hit ENTER to confirm.\n");
    printf("Password:");

    while(getch() != ENTER){
        ch = getch();
        pwd[i++] = ch;
        printf("* \b");
    }
    if(ch == ENTER || ch == TAB){
        pwd[i] = '\0';
    }

    printf("\n\nPassword:%s\nLength:%d\n\n", pwd, i);
    return 0;
}

https://stackoverflow.com/questions/6856635/hide-password-input-on-terminal — zerocool, Aug 22 '20 at 17:27
Does this answer your question? [Hide password input on terminal](https://stackoverflow.com/questions/6856635/hide-password-input-on-terminal) — Thomas Dickey, Aug 23 '20 at 01:01

Andy · Answer 1 · 2020-08-22T17:22:29.657

2

You are supposed to call initscr(); before you start using any ncurses methods. So, try doing this:

int main(){
    int i = 0;
    char ch;

    initscr();
    // ...

More information.

edited Aug 22 '20 at 17:22

answered Aug 22 '20 at 17:20

Andy

12,859
5
41
56

I tried but i get this when starting the program:`Enter your password. Hit ENTER to confirm. Password:(B)0` – tecn603 Aug 22 '20 at 17:22
@tecn603 -- OK, but this solved the issue you were having in your question, correct? – Andy Aug 22 '20 at 17:22
inserting `initscr ();` the asterisks are no longer printed, but the program does not work anyway, if I insert characters they are not obscured – tecn603 Aug 22 '20 at 17:24
Yes, but that's not what you asked about. :) Anyway, I think you need to call `noecho()`. – Snild Dolkow Aug 22 '20 at 17:27

score 0 · Answer 2 · answered Aug 22 '20 at 17:25

0

Looks like you're getting ERR returned from getch().

That is not equal to ENTER, so the loop is entered and repeated. Eventually, you run out of room in pwd, but continue writing outside it. The segmentation fault means that you tried to write some address that is unwriteable.

You also have a bug in that you call getch() twice per loop, which will give you trouble even after fixing the loop/segfault issue.

answered Aug 22 '20 at 17:25

Snild Dolkow

6,669
3
20
32

I have imagined that the segmentation fault depends on the fact that I try to write to other memory addresses, but in reality, however, the program tries to write even if I do not insert any input. From what I see it looks like getch () returns -1 – tecn603 Aug 22 '20 at 17:29
That is the [value of `ERR`](https://github.com/mirror/ncurses/blob/master/include/curses.h.in#L368). – Snild Dolkow Aug 23 '20 at 04:10

user3629249 · Answer 3 · 2020-08-23T17:14:44.030

regarding:

while(getch() != ENTER){
    ch = getch();

this gets 2 characters every pass through the loop. Not what you want. Suggest:

while( ( ch = getch() ) != ENTER ){

To avoid echoing the char when the user enters it: You need to turn echo off then for each char entered by the user, output a masking character, like *

since the array pwd[] is only 100 characters long, need to limit the number of characters the user can enter to 99 (leaves room for the trailing NUL byte) Suggest:

 WINDOW *mainwin;
 mainwin = initscr();   /* start the curses mode with default window */
 clear()    /* clear the default window */
 ...
 raw();     /* stop terminal driver from interpreting key strokes */ 
 cbreak();  /* input chars without waiting for newline */
 
 nodelay( mainwin, true); /* causes getch() to wait for a key rather than returning ERR */
 keypad( mainwin, true ); /* program must handle all meta keys including newline */

 noecho();  /* stop terminal echo while entering password */

 size_t i = 0;
 while( i < (sizeof( pwd ) -1) && ( ch = getch() ) != ENTER )
 {
     pwd[i] = ch;
     i++;

     printw( "*" );
     refresh();
 }

 echo();               /* resume echoing characters on terminal */
 keypad( mainwin, false );      /* stop passing keypad chars to program */
 noraw();              /* terminal driver resumes interpreting key strokes */

 pwd[i] = '\0';        /* NUL terminate the string */   
 ...
 endwin();

The above may be a bit of overkill.

due to several problems, suggest NOT using the C library function: getpass()

if you use the raw() function, then the program will also need to handle backspace (and similar) characters from the user.

Masking the characters of a password in a C program on Linux

3 Answers3