11 files changed, 64 insertions, 65 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index bd12b191..dc521570 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -59,7 +59,7 @@ if (LD_LIBRARY_PATH)
         add_definitions(-D_LD_LIBRARY_PATH="${LD_LIBRARY_PATH}")
 endif()
 
-find_package(JsonC REQUIRED)
+find_package(JsonC 0.12.1 REQUIRED)
 find_package(PCRE REQUIRED)
 find_package(WLC REQUIRED)
 find_package(Wayland REQUIRED)
diff --git a/README.de.md b/README.de.md
index 293ffe70..701cc34f 100644
--- a/README.de.md
+++ b/README.de.md
@@ -60,7 +60,7 @@ Abhängigkeiten:
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/README.el.md b/README.el.md
index eba97b9c..df39364f 100644
--- a/README.el.md
+++ b/README.el.md
@@ -53,7 +53,7 @@ To username μου στο Freenode είναι kon14 και θα με βρείτ�
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/README.fr.md b/README.fr.md
index a4ff7cb9..47b6c410 100644
--- a/README.fr.md
+++ b/README.fr.md
@@ -55,7 +55,7 @@ Installez les dépendances :
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/README.it.md b/README.it.md
index ded441c3..f5e0d8e2 100644
--- a/README.it.md
+++ b/README.it.md
@@ -56,7 +56,7 @@ Installa queste dipendenze:
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/README.ja.md b/README.ja.md
index 94b4ce9d..2e8f9bfb 100644
--- a/README.ja.md
+++ b/README.ja.md
@@ -46,7 +46,7 @@ Swayは沢山のディストリビューションで提供されています。"
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/README.md b/README.md
index eeca9f88..29e8a674 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ Install dependencies:
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/README.pt.md b/README.pt.md
index e35849ec..b5ca132f 100644
--- a/README.pt.md
+++ b/README.pt.md
@@ -62,7 +62,7 @@ Antes de iniciar a compilação, instale as dependências:
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/README.ru.md b/README.ru.md
index 1551caa0..4035b0fc 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -55,7 +55,7 @@ Sway доступен во многих дистрибутивах и наход
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/README.uk.md b/README.uk.md
index c8520e4b..2e107afc 100644
--- a/README.uk.md
+++ b/README.uk.md
@@ -62,7 +62,7 @@ Sway доступний у багатьох дистрибутивах Linux (а
 * libcap
 * asciidoc
 * pcre
-* json-c
+* json-c <= 0.12.1
 * pango
 * cairo
 * gdk-pixbuf2 *
diff --git a/swaylock/main.c b/swaylock/main.c
index 7b7dd601..3208a45b 100644
--- a/swaylock/main.c
+++ b/swaylock/main.c
@@ -6,6 +6,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/mman.h>
 #include <sys/types.h>
 #include <pwd.h>
 #include <getopt.h>
@@ -56,8 +57,7 @@ void sway_terminate(int exit_code) {
         exit(exit_code);
 }
 
-char *password;
-int password_size;
+char password[1024];
 enum line_source line_source = LINE_SOURCE_DEFAULT;
 
 struct lock_config *init_config() {
@@ -115,7 +115,7 @@ int function_conversation(int num_msg, const struct pam_message **msg,
                 switch (msg[i]->msg_style) {
                 case PAM_PROMPT_ECHO_OFF:
                 case PAM_PROMPT_ECHO_ON:
-                        pam_reply[i].resp = password;
+                        pam_reply[i].resp = strdup(password); // PAM clears and frees this
                         break;
 
                 case PAM_ERROR_MSG:
@@ -127,9 +127,15 @@ int function_conversation(int num_msg, const struct pam_message **msg,
         return PAM_SUCCESS;
 }
 
-/**
- * Note: PAM will free() 'password' during the process
- */
+void clear_password_buffer() {
+        // Use volatile keyword so so compiler can't optimize this out.
+        volatile char *pw = password;
+        volatile char zero = '\0';
+        for (size_t i = 0; i < sizeof(password); ++i) {
+                pw[i] = zero;
+        }
+}
+
 bool verify_password() {
         struct passwd *passwd = getpwuid(getuid());
         char *username = passwd->pw_name;
@@ -151,8 +157,7 @@ bool verify_password() {
 
 void notify_key(enum wl_keyboard_key_state state, xkb_keysym_t sym, uint32_t code, uint32_t codepoint) {
         int redraw_screen = 0;
-        char *password_realloc;
-        int i;
+        size_t i;
 
         if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
                 switch (sym) {
@@ -165,14 +170,14 @@ void notify_key(enum wl_keyboard_key_state state, xkb_keysym_t sym, uint32_t cod
                         wl_dispatch_events();
 
                         if (verify_password()) {
+                                clear_password_buffer();
                                 exit(0);
                         }
 
                         render_data.auth_state = AUTH_STATE_INVALID;
                         redraw_screen = 1;
 
-                        password_size = 1024;
-                        password = malloc(password_size);
+                        clear_password_buffer();
                         password[0] = '\0';
                         break;
                 case XKB_KEY_BackSpace:
@@ -207,9 +212,7 @@ void notify_key(enum wl_keyboard_key_state state, xkb_keysym_t sym, uint32_t cod
                                 render_data.auth_state = AUTH_STATE_BACKSPACE;
                                 redraw_screen = 1;
 
-                                password_size = 1024;
-                                free(password);
-                                password = malloc(password_size);
+                                clear_password_buffer();
                                 password[0] = '\0';
                                 break;
                         }
@@ -218,22 +221,10 @@ void notify_key(enum wl_keyboard_key_state state, xkb_keysym_t sym, uint32_t cod
                         render_data.auth_state = AUTH_STATE_INPUT;
                         redraw_screen = 1;
                         i = strlen(password);
-                        if (i + 1 == password_size) {
-                                password_size += 1024;
-                                password_realloc = realloc(password, password_size);
-                                // reset password if realloc fails.
-                                if (password_realloc == NULL) {
-                                        password_size = 1024;
-                                        free(password);
-                                        password = malloc(password_size);
-                                        password[0] = '\0';
-                                        break;
-                                } else {
-                                        password = password_realloc;
-                                }
+                        if (i + 1 < sizeof(password)) {
+                                password[i] = (char)codepoint;
+                                password[i + 1] = '\0';
                         }
-                        password[i] = (char)codepoint;
-                        password[i + 1] = '\0';
                         break;
                 }
                 if (redraw_screen) {
@@ -343,6 +334,7 @@ cairo_surface_t *load_image(char *image_path) {
 
 int main(int argc, char **argv) {
         const char *scaling_mode_str = "fit", *socket_path = NULL;
+        char *image_path = NULL;
         int i;
         void *images = NULL;
         config = init_config();
@@ -400,8 +392,6 @@ int main(int argc, char **argv) {
                 "  For more information see `man swaylock`\n";
 
 
-        registry = registry_poll();
-
         int c;
         while (1) {
                 int option_index = 0;
@@ -418,29 +408,7 @@ int main(int argc, char **argv) {
                 }
                 case 'i':
                 {
-                        char *image_path = strchr(optarg, ':');
-                        if (image_path == NULL) {
-                                if (render_data.num_images == 0) {
-                                        // Provided image without output
-                                        render_data.image = load_image(optarg);
-                                        render_data.num_images = -1;
-                                } else {
-                                        sway_log(L_ERROR, "output must be defined for all --images or no --images");
-                                        exit(EXIT_FAILURE);
-                                }
-                        } else {
-                                // Provided image for all outputs
-                                if (render_data.num_images == 0) {
-                                        images = calloc(registry->outputs->length, sizeof(char*) * 2);
-                                } else if (render_data.num_images == -1) {
-                                        sway_log(L_ERROR, "output must be defined for all --images or no --images");
-                                        exit(EXIT_FAILURE);
-                                }
-
-                                image_path[0] = '\0';
-                                ((char**) images)[render_data.num_images * 2] = optarg;
-                                ((char**) images)[render_data.num_images++ * 2 + 1] = ++image_path;
-                        }
+                        image_path = optarg;
                         break;
                 }
                 case 't':
@@ -519,6 +487,33 @@ int main(int argc, char **argv) {
                         exit(EXIT_FAILURE);
                 }
         }
+        registry = registry_poll();
+
+        if (image_path) {
+                char *path = strchr(image_path, ':');
+                if (path == NULL) {
+                        if (render_data.num_images == 0) {
+                                // Provided image without output
+                                render_data.image = load_image(image_path);
+                                render_data.num_images = -1;
+                        } else {
+                                sway_log(L_ERROR, "output must be defined for all --images or no --images");
+                                exit(EXIT_FAILURE);
+                        }
+                } else {
+                        // Provided image for all outputs
+                        if (render_data.num_images == 0) {
+                                images = calloc(registry->outputs->length, sizeof(char*) * 2);
+                        } else if (render_data.num_images == -1) {
+                                sway_log(L_ERROR, "output must be defined for all --images or no --images");
+                                exit(EXIT_FAILURE);
+                        }
+
+                        path[0] = '\0';
+                        ((char**) images)[render_data.num_images * 2] = image_path;
+                        ((char**) images)[render_data.num_images++ * 2 + 1] = ++path;
+                }
+        }
 
         render_data.scaling_mode = SCALING_MODE_STRETCH;
         if (strcmp(scaling_mode_str, "stretch") == 0) {
@@ -535,8 +530,12 @@ int main(int argc, char **argv) {
                 sway_abort("Unsupported scaling mode: %s", scaling_mode_str);
         }
 
-        password_size = 1024;
-        password = malloc(password_size);
+#ifdef __linux__
+        // Most non-linux platforms require root to mlock()
+        if (mlock(password, sizeof(password)) != 0) {
+                sway_abort("Unable to mlock() password memory.");
+        }
+#endif
         password[0] = '\0';
         render_data.surfaces = create_list();
         if (!socket_path) {