Skip to content

Segfault when panel.replace() is given a detached window #155860

Description

@fedonman

Bug description:

curses.screen.close() detaches the screen's standard window. panel.replace() accepts that detached window and stores its NULL window in the panel, and the panel then dereferences it inside libpanel.

import curses, curses.panel, pty

screen = curses.newterm(None, pty.openpty()[1], pty.openpty()[1])
win = screen.stdscr
panel = curses.panel.new_panel(curses.newwin(3, 6, 0, 0))
screen.close()                  # win is now detached
panel.replace(win)              # accepted, stores a NULL window
panel.move(1, 1)                # dereferenced inside libpanel
$ TERM=xterm-256color ./python repro.py; echo "rc=$?"
Segmentation fault (core dumped)
rc=139

Expected: panel.replace() raises curses.panel.error, the way new_panel() already does when handed the same window.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.16new features, bugs and security fixesextension-modulesC modules in the Modules dirtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions