From: Daniel Dickman <didickman@gmail.com>
Subject: Re: getty: prevent sending empty login names to login(1)
To: Piotr Durlej <pdurlej@cat4u.org>
Cc: tech@openbsd.org
Date: Tue, 21 Jul 2026 18:18:44 -0400

Hi Piotr, does the below fix this issue for you?

Index: main.c
===================================================================
RCS file: /cvs/src/libexec/getty/main.c,v
diff -u -p -u -r1.56 main.c
--- main.c	19 Jul 2024 15:28:51 -0000	1.56
+++ main.c	21 Jul 2026 22:12:20 -0000
@@ -314,6 +314,8 @@ main(int argc, char *argv[])
 			oflush();
 			alarm(0);
 			signal(SIGALRM, SIG_DFL);
+			if (name[0] == '\0')
+				continue;
 			if (name[0] == '-') {
 				xputs("user names may not start with '-'.");
 				continue;


On Fri, 17 Jul 2026, Piotr Durlej wrote:

> Hello,
> 
> this patch prevents getty(8) from sending empty login names to login(1).
> 
> To reproduce the bug, type some characters, erase the entire line and press
> enter/return.
> 
> ---
>  libexec/getty/main.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/libexec/getty/main.c b/libexec/getty/main.c
> index 74b3aa27779..5726d5d6838 100644
> --- a/libexec/getty/main.c
> +++ b/libexec/getty/main.c
> @@ -59,7 +59,7 @@
>  
>  struct termios tmode, omode;
>  
> -int crmod, digit, lower, upper;
> +int crmod, lower;
>  
>  char	hostname[HOST_NAME_MAX+1];
>  char	globalhostname[HOST_NAME_MAX+1];
> @@ -318,7 +318,10 @@ main(int argc, char *argv[])
>  				xputs("user names may not start with '-'.");
>  				continue;
>  			}
> -			if (!(upper || lower || digit))
> +			for (i = 0; name[i]; i++)
> +				if (isalnum(name[i]))
> +					break;
> +			if (name[i] == '\0')
>  				continue;
>  			setflags(2);
>  			if (crmod) {
> @@ -381,7 +384,7 @@ getname(void)
>  		syslog(LOG_ERR, "%s: %m", ttyn);
>  		exit(1);
>  	}
> -	crmod = digit = lower = upper = 0;
> +	crmod = lower = 0;
>  	np = name;
>  	for (;;) {
>  		oflush();
> @@ -409,8 +412,6 @@ getname(void)
>  		}
>  		if (islower(c))
>  			lower = 1;
> -		else if (isupper(c))
> -			upper = 1;
>  		else if (c == ERASE || c == '\b') {
>  			if (np > name) {
>  				if (*--np == '\033')
> @@ -432,8 +433,7 @@ getname(void)
>  			prompt();
>  			np = name;
>  			continue;
> -		} else if (isdigit(c))
> -			digit++;
> +		}
>  		if (IG && (c <= ' ' || c > 0176))
>  			continue;
>  		*np++ = c;
> -- 
> 2.53.0
> 
>