NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

lib/53801: Segmentation fault in curses with pads

>Number:         53801
>Category:       lib
>Synopsis:       Segmentation fault in curses with pads
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Dec 19 07:45:00 +0000 2018
>Originator:     C. McEnroe
>Release:        8.0
NetBSD monday 8.0 NetBSD 8.0 (RPI2) #0: Tue Jul 17 14:59:51 UTC 2018 evbarm
A call to wmove(3) following a call to prefresh(3) where the pad is drawn to the screen at coordinates outside the bounds of the pad will result in a segmentation fault. The call to prefresh(3) sets pad->cury and pad->curx out of bounds, and wmove(3) accesses pad->alines using those coordinates.
#include <curses.h>
int main(void) {
        WINDOW *pad = newpad(1, COLS);
        prefresh(pad, 0, 0, 5, 0, 5, COLS - 1);
        wmove(pad, 0, 0);
pad->cury and pad->curx get set in prefresh on refresh.c:485. The LEAVEOK check above this seems inverted: the cursor position is changed when LEAVEOK is *not* set. The same appears in wrefresh. The position calculation is copied from wrefresh and results in coordinates outside of the pad bounds.

Home | Main Index | Thread Index | Old Index