[New-bugs-announce] [issue44172] curses module may call delwin() on original window before subwindows

[Michael Forney]

New submission from Michael Forney <mforney at mforney.org>:

When subwin() is used to create a subwindow for an original window, it does not keep a reference to the original window object. This can result in the original window getting deleted with delwin() before the subwindow.

According to the X/Open curses specification[0]:
> The application must delete subwindows before deleting the main window.

This is also mentioned in the ncurses documentation[1]:
> Subwindows must be deleted before the main window can be deleted.

When building the Python curses module against NetBSD's curses implementation, deleting the windows in the wrong order causes a double-free. This results in hanging or crashing when running test_curses.

To fix this, window objects for subwindows should keep a reference to the original window object.

[0] https://pubs.opengroup.org/onlinepubs/7908799/xcurses/delwin.html
[1] https://invisible-island.net/ncurses/man/curs_window.3x.html

----------
components: Extension Modules
messages: 393916
nosy: michaelforney
priority: normal
severity: normal
status: open
title: curses module may call delwin() on original window before subwindows
type: crash
versions: Python 3.10, Python 3.11, Python 3.6, Python 3.7, Python 3.8, Python 3.9

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue44172>
_______________________________________