bpo-44172: Keep reference to original window in curses subwindow objects (GH-26226)

michaelforney · serhiy-storchaka · web-flow · commit 0af61fe2f410 · 2025-05-04T13:29:44.000+03:00
The X/Open curses specification[0] and ncurses documentation[1] both state that subwindows must be deleted before the main window. Deleting the windows in the wrong order causes a double-free with NetBSD's curses implementation. To fix this, keep track of the original window object in the subwindow object, and keep a reference to the original for the lifetime of the subwindow. [0] https://pubs.opengroup.org/onlinepubs/7908799/xcurses/delwin.html [1] https://invisible-island.net/ncurses/man/curs_window.3x.html Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
diff --git a/Include/py_curses.h b/Include/py_curses.h
@@ -75,10 +75,11 @@ extern "C" {
 
 /* Type declarations */
 
-typedef struct {
+typedef struct PyCursesWindowObject {
     PyObject_HEAD
     WINDOW *win;
     char *encoding;
+    struct PyCursesWindowObject *orig;
 } PyCursesWindowObject;
 
 #define PyCurses_CAPSULE_NAME "_curses._C_API"
diff --git a/Lib/test/test_curses.py b/Lib/test/test_curses.py
@@ -8,7 +8,8 @@
 from unittest.mock import MagicMock
 
 from test.support import (requires, verbose, SaveSignals, cpython_only,
-                          check_disallow_instantiation, MISSING_C_DOCSTRINGS)
+                          check_disallow_instantiation, MISSING_C_DOCSTRINGS,
+                          gc_collect)
 from test.support.import_helper import import_module
 
 # Optionally test curses module.  This currently requires that the
@@ -181,6 +182,14 @@ def test_create_windows(self):
         self.assertEqual(win3.getparyx(), (2, 1))
         self.assertEqual(win3.getmaxyx(), (6, 11))
 
+    def test_subwindows_references(self):
+        win = curses.newwin(5, 10)
+        win2 = win.subwin(3, 7)
+        del win
+        gc_collect()
+        del win2
+        gc_collect()
+
     def test_move_cursor(self):
         stdscr = self.stdscr
         win = stdscr.subwin(10, 15, 2, 5)
diff --git a/Misc/NEWS.d/next/Library/2021-05-18-19-12-58.bpo-44172.rJ_-CI.rst b/Misc/NEWS.d/next/Library/2021-05-18-19-12-58.bpo-44172.rJ_-CI.rst
@@ -0,0 +1,2 @@
+Keep a reference to original :mod:`curses` windows in subwindows so
+that the original window does not get deleted before subwindows.
diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c
@@ -787,7 +787,8 @@ Window_TwoArgNoReturnFunction(wresize, int, "ii;lines,columns")
 
 static PyObject *
 PyCursesWindow_New(cursesmodule_state *state,
-                   WINDOW *win, const char *encoding)
+                   WINDOW *win, const char *encoding,
+                   PyCursesWindowObject *orig)
 {
     if (encoding == NULL) {
 #if defined(MS_WINDOWS)
@@ -821,6 +822,8 @@ PyCursesWindow_New(cursesmodule_state *state,
         PyErr_NoMemory();
         return NULL;
     }
+    wo->orig = orig;
+    Py_XINCREF(orig);
     PyObject_GC_Track((PyObject *)wo);
     return (PyObject *)wo;
 }
@@ -838,6 +841,7 @@ PyCursesWindow_dealloc(PyObject *self)
     if (wo->encoding != NULL) {
         PyMem_Free(wo->encoding);
     }
+    Py_XDECREF(wo->orig);
     window_type->tp_free(self);
     Py_DECREF(window_type);
 }
@@ -846,6 +850,8 @@ static int
 PyCursesWindow_traverse(PyObject *self, visitproc visit, void *arg)
 {
     Py_VISIT(Py_TYPE(self));
+    PyCursesWindowObject *wo = (PyCursesWindowObject *)self;
+    Py_VISIT(wo->orig);
     return 0;
 }
 
@@ -1453,7 +1459,7 @@ _curses_window_derwin_impl(PyCursesWindowObject *self, int group_left_1,
     }
 
     cursesmodule_state *state = get_cursesmodule_state_by_win(self);
-    return PyCursesWindow_New(state, win, NULL);
+    return PyCursesWindow_New(state, win, NULL, self);
 }
 
 /*[clinic input]
@@ -2493,7 +2499,7 @@ _curses_window_subwin_impl(PyCursesWindowObject *self, int group_left_1,
     }
 
     cursesmodule_state *state = get_cursesmodule_state_by_win(self);
-    return PyCursesWindow_New(state, win, self->encoding);
+    return PyCursesWindow_New(state, win, self->encoding, self);
 }
 
 /*[clinic input]
@@ -3237,7 +3243,7 @@ _curses_getwin(PyObject *module, PyObject *file)
         goto error;
     }
     cursesmodule_state *state = get_cursesmodule_state(module);
-    res = PyCursesWindow_New(state, win, NULL);
+    res = PyCursesWindow_New(state, win, NULL, NULL);
 
 error:
     fclose(fp);
@@ -3410,7 +3416,7 @@ _curses_initscr_impl(PyObject *module)
     if (curses_initscr_called) {
         wrefresh(stdscr);
         cursesmodule_state *state = get_cursesmodule_state(module);
-        return PyCursesWindow_New(state, stdscr, NULL);
+        return PyCursesWindow_New(state, stdscr, NULL, NULL);
     }
 
     win = initscr();
@@ -3514,7 +3520,7 @@ _curses_initscr_impl(PyObject *module)
 #undef SetDictInt
 
     cursesmodule_state *state = get_cursesmodule_state(module);
-    PyObject *winobj = PyCursesWindow_New(state, win, NULL);
+    PyObject *winobj = PyCursesWindow_New(state, win, NULL, NULL);
     if (winobj == NULL) {
         return NULL;
     }
@@ -3898,7 +3904,7 @@ _curses_newpad_impl(PyObject *module, int nlines, int ncols)
     }
 
     cursesmodule_state *state = get_cursesmodule_state(module);
-    return PyCursesWindow_New(state, win, NULL);
+    return PyCursesWindow_New(state, win, NULL, NULL);
 }
 
 /*[clinic input]
@@ -3939,7 +3945,7 @@ _curses_newwin_impl(PyObject *module, int nlines, int ncols,
     }
 
     cursesmodule_state *state = get_cursesmodule_state(module);
-    return PyCursesWindow_New(state, win, NULL);
+    return PyCursesWindow_New(state, win, NULL, NULL);
 }
 
 /*[clinic input]

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Keep a reference to original :mod:`curses` windows in subwindows so
	`2`	`+that the original window does not get deleted before subwindows.`
Original file line number	Diff line number	Diff line change
`@@ -787,7 +787,8 @@ Window_TwoArgNoReturnFunction(wresize, int, "ii;lines,columns")`
`787`	`787`
`788`	`788`	`static PyObject *`
`789`	`789`	`PyCursesWindow_New(cursesmodule_state *state,`
`790`		`- WINDOW win, const char encoding)`
	`790`	`+ WINDOW win, const char encoding,`
	`791`	`+ PyCursesWindowObject *orig)`
`791`	`792`	`{`
`792`	`793`	`if (encoding == NULL) {`
`793`	`794`	`#if defined(MS_WINDOWS)`
`@@ -821,6 +822,8 @@ PyCursesWindow_New(cursesmodule_state *state,`
`821`	`822`	`PyErr_NoMemory();`
`822`	`823`	`return NULL;`
`823`	`824`	`}`
	`825`	`+ wo->orig = orig;`
	`826`	`+ Py_XINCREF(orig);`
`824`	`827`	`PyObject_GC_Track((PyObject *)wo);`
`825`	`828`	`return (PyObject *)wo;`
`826`	`829`	`}`
`@@ -838,6 +841,7 @@ PyCursesWindow_dealloc(PyObject *self)`
`838`	`841`	`if (wo->encoding != NULL) {`
`839`	`842`	`PyMem_Free(wo->encoding);`
`840`	`843`	`}`
	`844`	`+ Py_XDECREF(wo->orig);`
`841`	`845`	`window_type->tp_free(self);`
`842`	`846`	`Py_DECREF(window_type);`
`843`	`847`	`}`
`@@ -846,6 +850,8 @@ static int`
`846`	`850`	`PyCursesWindow_traverse(PyObject self, visitproc visit, void arg)`
`847`	`851`	`{`
`848`	`852`	`Py_VISIT(Py_TYPE(self));`
	`853`	`+ PyCursesWindowObject wo = (PyCursesWindowObject )self;`
	`854`	`+ Py_VISIT(wo->orig);`
`849`	`855`	`return 0;`
`850`	`856`	`}`
`851`	`857`
`@@ -1453,7 +1459,7 @@ _curses_window_derwin_impl(PyCursesWindowObject *self, int group_left_1,`
`1453`	`1459`	`}`
`1454`	`1460`
`1455`	`1461`	`cursesmodule_state *state = get_cursesmodule_state_by_win(self);`
`1456`		`- return PyCursesWindow_New(state, win, NULL);`
	`1462`	`+ return PyCursesWindow_New(state, win, NULL, self);`
`1457`	`1463`	`}`
`1458`	`1464`
`1459`	`1465`	`/*[clinic input]`
`@@ -2493,7 +2499,7 @@ _curses_window_subwin_impl(PyCursesWindowObject *self, int group_left_1,`
`2493`	`2499`	`}`
`2494`	`2500`
`2495`	`2501`	`cursesmodule_state *state = get_cursesmodule_state_by_win(self);`
`2496`		`- return PyCursesWindow_New(state, win, self->encoding);`
	`2502`	`+ return PyCursesWindow_New(state, win, self->encoding, self);`
`2497`	`2503`	`}`
`2498`	`2504`
`2499`	`2505`	`/*[clinic input]`
`@@ -3237,7 +3243,7 @@ _curses_getwin(PyObject module, PyObject file)`
`3237`	`3243`	`goto error;`
`3238`	`3244`	`}`
`3239`	`3245`	`cursesmodule_state *state = get_cursesmodule_state(module);`
`3240`		`- res = PyCursesWindow_New(state, win, NULL);`
	`3246`	`+ res = PyCursesWindow_New(state, win, NULL, NULL);`
`3241`	`3247`
`3242`	`3248`	`error:`
`3243`	`3249`	`fclose(fp);`
`@@ -3410,7 +3416,7 @@ _curses_initscr_impl(PyObject *module)`
`3410`	`3416`	`if (curses_initscr_called) {`
`3411`	`3417`	`wrefresh(stdscr);`
`3412`	`3418`	`cursesmodule_state *state = get_cursesmodule_state(module);`
`3413`		`- return PyCursesWindow_New(state, stdscr, NULL);`
	`3419`	`+ return PyCursesWindow_New(state, stdscr, NULL, NULL);`
`3414`	`3420`	`}`
`3415`	`3421`
`3416`	`3422`	`win = initscr();`
`@@ -3514,7 +3520,7 @@ _curses_initscr_impl(PyObject *module)`
`3514`	`3520`	`#undef SetDictInt`
`3515`	`3521`
`3516`	`3522`	`cursesmodule_state *state = get_cursesmodule_state(module);`
`3517`		`- PyObject *winobj = PyCursesWindow_New(state, win, NULL);`
	`3523`	`+ PyObject *winobj = PyCursesWindow_New(state, win, NULL, NULL);`
`3518`	`3524`	`if (winobj == NULL) {`
`3519`	`3525`	`return NULL;`
`3520`	`3526`	`}`
`@@ -3898,7 +3904,7 @@ _curses_newpad_impl(PyObject *module, int nlines, int ncols)`
`3898`	`3904`	`}`
`3899`	`3905`
`3900`	`3906`	`cursesmodule_state *state = get_cursesmodule_state(module);`
`3901`		`- return PyCursesWindow_New(state, win, NULL);`
	`3907`	`+ return PyCursesWindow_New(state, win, NULL, NULL);`
`3902`	`3908`	`}`
`3903`	`3909`
`3904`	`3910`	`/*[clinic input]`
`@@ -3939,7 +3945,7 @@ _curses_newwin_impl(PyObject *module, int nlines, int ncols,`
`3939`	`3945`	`}`
`3940`	`3946`
`3941`	`3947`	`cursesmodule_state *state = get_cursesmodule_state(module);`
`3942`		`- return PyCursesWindow_New(state, win, NULL);`
	`3948`	`+ return PyCursesWindow_New(state, win, NULL, NULL);`
`3943`	`3949`	`}`
`3944`	`3950`
`3945`	`3951`	`/*[clinic input]`