[issue35924] curses segfault resizing window

[Toshio Kuratomi]

Toshio Kuratomi <a.badger at gmail.com> added the comment:

I'm still debugging this but it may be an off-by-one error in ncurses, wresize.c.  I've found that if I modify the following section in ncurses, our problem goes away:

    /*
       * Dispose of unwanted memory.
       */
      if (!(win->_flags & _SUBWIN)) { 
          if (ToCols == size_x) { 
              for (row = ToLines + 1; row <= size_y; row++) { 
                   free(win->_line[row].text);
              } 
          } else { 
              for (row = 0; row <= size_y; row++) { 
                   free(win->_line[row].text);
              } 
          }
      } 
  
      free(win->_line);
      win->_line = new_lines;

Replacing:
              for (row = ToLines + 1; row <= size_y; row++) { 
with:
              for (row = ToLines + 2; row <= size_y; row++) { 

fixes this error.  ToLines is a parameter passed in to wresize.  wresize will reuse ToLines number of rows from the old structure in the new structure.  Due to that, I think that the chances are good that it is ncurses which is at fault here.  I will try to rewrite the test case into a C program and then submit a bug report to ncurses upstream.  I'm not sure that there's a way we can work around this until that's fixed.

----------
nosy: +a.badger

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue35924>
_______________________________________