Hi.

I use x11vnc on my GNOME workstation so that I can access it the same way I would if I were in front of it. Today, I typed my password at GDM login prompt but somehow, an extra character ended-up in my password box and the following appeared in /var/log/messages:

Feb 15 16:14:54 foostation gdmlogin[20771]: WARNING: string not in proper utf8 encoding: "pwd@\M-C\240@\M-C\240"

In this case my password was "pwd@@".
This is a major security concern especially since /var/log/messages is readable by anyone!

This is under OpenBSD with GNOME-2.24.3 and GDM-2.20.9.
I mentioned x11vnc because I think it was the reason I was able to insert a non proper encoding.

For now, I'm just using this to make sure my password does not end up in the logs...


--- common/gdm-common.c.orig    Sun Feb 15 16:49:17 2009
+++ common/gdm-common.c Sun Feb 15 16:49:58 2009
@@ -230,7 +230,7 @@ ve_locale_from_utf8 (const char *str)
        char *ret = g_locale_from_utf8 (str, -1, NULL, NULL, NULL);
 
        if (ret == NULL) {
-               g_warning ("string not in proper utf8 encoding: \"%s\"", str);
+               g_warning ("string not in proper utf8 encoding");
                return g_strdup (str);
        } else {
                return ret;