Thanks to visit codestin.com
Credit goes to github.com

Skip to content

gh-120378: Fix crash caused by integer overflow in curses #124555

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Oct 2, 2024

Conversation

ZeroIntensity
Copy link
Member

@ZeroIntensity ZeroIntensity commented Sep 25, 2024

This is actually an upstream problem in curses, and has been reported to them already. This is a nice workaround in the meantime to prevent the segfault.

@ZeroIntensity
Copy link
Member Author

cc @picnixz

@picnixz
Copy link
Member

picnixz commented Sep 26, 2024

I'll have a look after sleeping a bit. By the way, instead of cc'ing me, you can just outright request a review from me when you know I've been active on the corresponding issue (I'll reject it if I deem myself not enough an expert).

@picnixz picnixz self-requested a review September 26, 2024 00:16
@ZeroIntensity
Copy link
Member Author

I'll have a look after sleeping a bit. By the way, instead of cc'ing me, you can just outright request a review from me when you know I've been active on the corresponding issue (I'll reject it if I deem myself not enough an expert).

I was under the impression that requesting a review didn't result in a notification, good to know!

Copy link
Member

@picnixz picnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the resize_term function also suffer from the same issue?

@ZeroIntensity
Copy link
Member Author

Does the resize_term function also suffer from the same issue?

It does, but it seems that this patch fixes the issue for both of them. I guess I'll test for it too.

@picnixz
Copy link
Member

picnixz commented Oct 2, 2024

Ok, by the way I know why we export unconditionally the method. Actually, it would be a no-op if the method is not available (see the clinic generated code which does #define _CURSES_RESIZE_TERM_METHODDEF at the very end). So what I thought was wrong is actually fine.

@picnixz picnixz self-requested a review October 2, 2024 12:39
@ZeroIntensity
Copy link
Member Author

I think I fixed it by moving that test, anyway. Anything else to do here?

@picnixz
Copy link
Member

picnixz commented Oct 2, 2024

I think I fixed it by moving that test, anyway. Anything else to do here?

No, nothing else to do! (at least AFAICT).

@ZeroIntensity
Copy link
Member Author

Now, time to find a core dev to review this. I don't think we have anyone active that's worked much on curses, do we?

@picnixz
Copy link
Member

picnixz commented Oct 2, 2024

No, but Victor has been reviewing my curses (and not my cursed) PRs so I think we can ask him.

@ZeroIntensity ZeroIntensity requested a review from vstinner October 2, 2024 14:15
Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@vstinner vstinner enabled auto-merge (squash) October 2, 2024 14:22
@vstinner vstinner merged commit c2ba931 into python:main Oct 2, 2024
41 checks passed
@miss-islington-app
Copy link

Thanks @ZeroIntensity for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 2, 2024
…thonGH-124555)

This is actually an upstream problem in curses, and has been reported
to them already:
https://lists.gnu.org/archive/html/bug-ncurses/2024-09/msg00101.html

This is a nice workaround in the meantime to prevent the segfault.

(cherry picked from commit c2ba931)

Co-authored-by: Peter Bierma <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
@miss-islington-app
Copy link

Sorry, @ZeroIntensity and @vstinner, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c2ba931318280796a6dcc33d1a5c5c02ad4d035b 3.12

@bedevere-app
Copy link

bedevere-app bot commented Oct 2, 2024

GH-124905 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Oct 2, 2024
@vstinner
Copy link
Member

vstinner commented Oct 2, 2024

@ZeroIntensity: If you consider that backporting to 3.12 is worth it, would you mind to try to backport the change manually? The automated backport failed.

@vstinner
Copy link
Member

vstinner commented Oct 2, 2024

PR merged, thank you @ZeroIntensity. I'm not really super happy about this workaround, but it seems like upstream is not responsive on this crash.

@ZeroIntensity
Copy link
Member Author

@ZeroIntensity: If you consider that backporting to 3.12 is worth it, would you mind to try to backport the change manually? The automated backport failed.

Yeah, I can do that a little later today. It's odd that it worked for 3.13 but not 3.12, though.

@picnixz
Copy link
Member

picnixz commented Oct 2, 2024

Yeah, I can do that a little later today. It's odd that it worked for 3.13 but not 3.12, though.

This could be a clinic issue (where the generator changed between 3.12 and 3.13 and introduced conflicts).

ZeroIntensity added a commit to ZeroIntensity/cpython that referenced this pull request Oct 2, 2024
…es` (pythonGH-124555)

This is actually an upstream problem in curses, and has been reported
to them already:
https://lists.gnu.org/archive/html/bug-ncurses/2024-09/msg00101.html

This is a nice workaround in the meantime to prevent the segfault.

(cherry picked from commit c2ba931)

Co-authored-by: Peter Bierma <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
@bedevere-app
Copy link

bedevere-app bot commented Oct 2, 2024

GH-124911 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Oct 2, 2024
@ZeroIntensity ZeroIntensity deleted the curses-int-limit branch October 2, 2024 21:25
@vstinner
Copy link
Member

vstinner commented Oct 2, 2024

it seems like upstream is not responsive on this crash

Oh, the email was sent last week :-) So it's early to say that upstream is not responsive, sorry about that.

vstinner pushed a commit that referenced this pull request Oct 2, 2024
…H-124555) (#124911)

This is actually an upstream problem in curses, and has been reported
to them already:
https://lists.gnu.org/archive/html/bug-ncurses/2024-09/msg00101.html

This is a nice workaround in the meantime to prevent the segfault.

(cherry picked from commit c2ba931)

Co-authored-by: Bénédikt Tran <[email protected]>
vstinner pushed a commit that referenced this pull request Oct 7, 2024
…H-124555) (#124905)

gh-120378: Fix crash caused by integer overflow in `curses` (GH-124555)

This is actually an upstream problem in curses, and has been reported
to them already:
https://lists.gnu.org/archive/html/bug-ncurses/2024-09/msg00101.html

This is a nice workaround in the meantime to prevent the segfault.

(cherry picked from commit c2ba931)

Co-authored-by: Peter Bierma <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants