Use-after-free when `initscr()` or `newterm()` follows `new_prescr()` · Issue #155875 · python/cpython · GitHub
Skip to content

Use-after-free when initscr() or newterm() follows new_prescr() #155875

Description

@fedonman

Bug description:

curses.new_prescr() returns a screen object that calls delscreen() when it is collected. initscr() and newterm() adopt that pending screen but leave it owned by the pre-screen object, so letting that object go out of scope deletes the screen the program is running on.

import curses, pty

def start(fd):
    pre = curses.new_prescr()       # the documented way to set options first
    curses.use_env(False)
    return curses.newterm(None, fd, fd)

screen = start(pty.openpty()[1])    # pre goes out of scope here
screen.stdscr.addstr(0, 0, "x")
$ TERM=xterm-256color ./python repro.py; echo "rc=$?"
Segmentation fault (core dumped)
rc=139

curses.initscr() in place of newterm() crashes the same way.

Expected: adopting the pending screen leaves it owned by whatever the program is now using, so letting the new_prescr() object go out of scope does not free a live screen.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.16new features, bugs and security fixesextension-modulesC modules in the Modules dirtopic-cursestype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions