[wiki] [sites] [slock][patch][quickcancel] Port to 1.6 and fix clock vulnerability || Matthias Schoth

From: <git_AT_suckless.org>
Date: Sat, 11 Jul 2026 11:48:22 +0200

commit 943baf684e57c2277077c6fd19baf956f81308c2
Author: Matthias Schoth <mschoth_AT_gmail.com>
Date: Sat Jul 11 11:42:05 2026 +0200

    [slock][patch][quickcancel] Port to 1.6 and fix clock vulnerability
    
    - Refresh patch for slock 1.6
    - Fix severe security bug:
      Replace time(NULL) with clock_gettime(CLOCK_MONOTONIC, ...) so the
      lock cannot be bypassed by setting the system clock back

diff --git a/tools.suckless.org/slock/patches/quickcancel/index.md b/tools.suckless.org/slock/patches/quickcancel/index.md
index 5516e514..57bcfefa 100644
--- a/tools.suckless.org/slock/patches/quickcancel/index.md
+++ b/tools.suckless.org/slock/patches/quickcancel/index.md
_AT_@ -7,6 +7,7 @@ Cancel slock by moving the mouse within a certain time-period after slock starte
 
 Download
 --------
+* [slock-quickcancel-1.6.diff](slock-quickcancel-1.6.diff)
 * [slock-quickcancel-1.4.diff](slock-quickcancel-1.4.diff)
 * [slock-quickcancel-20160619-65b8d52.diff](slock-quickcancel-20160619-65b8d52.diff)
 
diff --git a/tools.suckless.org/slock/patches/quickcancel/slock-quickcancel-1.6.diff b/tools.suckless.org/slock/patches/quickcancel/slock-quickcancel-1.6.diff
new file mode 100644
index 00000000..ed9e3abd
--- /dev/null
+++ b/tools.suckless.org/slock/patches/quickcancel/slock-quickcancel-1.6.diff
_AT_@ -0,0 +1,70 @@
+From: Matthias Schoth <mschoth_AT_gmail.com>
+Date: Sat, 11 Jul 2026 11:15:49 +0200
+Subject: [PATCH] Apply quickcancel
+
+Cancel slock by moving the mouse within a certain time-period after
+slock started. The time-period can be defined in seconds with the
+setting *timetocancel* in the config.h. This is useful if you forgot to
+disable `xautolock` during an activity that requires no input (e.g.
+reading text, watching video).
+
+Changes from the 1.4 version: use CLOCK_MONOTONIC instead of time(NULL)
+to prevent bypassing the lock by setting the system clock back.
+
+---
+ config.def.h | 3 +++
+ slock.c | 9 +++++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/config.def.h b/config.def.h
+index 9855e21..e0bf95a 100644
+--- a/config.def.h
++++ b/config.def.h
+_AT_@ -10,3 +10,6 @@ static const char *colorname[NUMCOLS] = {
+
+ /* treat a cleared input like a wrong password (color) */
+ static const int failonclear = 1;
++
++/* time in seconds to cancel lock with mouse movement */
++static const int timetocancel = 4;
+diff --git a/slock.c b/slock.c
+index f16781f..212b482 100644
+--- a/slock.c
++++ b/slock.c
+_AT_@ -13,6 +13,7 @@
+ #include <stdio.h>
+ #include <string.h>
+ #include <unistd.h>
++#include <time.h>
+ #include <spawn.h>
+ #include <sys/types.h>
+ #include <X11/extensions/Xrandr.h>
+_AT_@ -25,6 +26,8 @@
+
+ char *argv0;
+
++static struct timespec locktime;
++
+ enum {
+ INIT,
+ INPUT,
+_AT_@ -142,6 +145,9 @@ readpw(Display *dpy, struct xrandr *rr, struct lock **locks, int nscreens,
+ oldc = INIT;
+
+ while (running && !XNextEvent(dpy, &ev)) {
++ struct timespec now;
++ clock_gettime(CLOCK_MONOTONIC, &now);
++ running = !((now.tv_sec - locktime.tv_sec < timetocancel) && (ev.type == MotionNotify));
+ if (ev.type == KeyPress) {
+ explicit_bzero(&buf, sizeof(buf));
+ num = XLookupString(&ev.xkey, buf, sizeof(buf), &ksym, 0);
+_AT_@ -280,6 +286,7 @@ lockscreen(Display *dpy, struct xrandr *rr, int screen)
+ XRRSelectInput(dpy, lock->win, RRScreenChangeNotifyMask);
+
+ XSelectInput(dpy, lock->root, SubstructureNotifyMask);
++ clock_gettime(CLOCK_MONOTONIC, &locktime);
+ return lock;
+ }
+
+--
+2.23.0
Received on Sat Jul 11 2026 - 11:48:22 CEST