Memory bug.

[Philippe Blain]

>From Philippe Blain, Bordeaux, FRANCE.
My old computer: P133 - 8,4 Go - 32 Mo Red Hat Linux 7.0

To maintainers of 'ncurses'.(and to Mr Dickey)
Subject: Corrections for ncurses-5.2-20020824+

Here are some problems I found :

----------------------------------------------------------------------------
----
File : ncurses/base/lib_newterm.c

Suppress that line (done by typeahead()) :

    SP->_ifd = fileno(ifp);
==> SP->_checkfd = fileno(ifp);
    typeahead(fileno(ifp));

----------------------------------------------------------------------------
----
File : ncurses/tinfo/doalloc.c

Function _nc_doalloc() :

When used for first allocation, that function is false :
the line    "newp = typeMalloc(char, amount);"
supposes that the type used is 'char' and allocates (amount*sizeof(char)).

But 'typeRealloc' uses that function with short, char and int as types.
You define it by :
#define typeRealloc(type,elts,ptr) (type *)_nc_doalloc(ptr,
(elts)*sizeof(type))

So, for first allocation, the type should be 'void' (not defined as the line
with 'realloc') and allocation of 'amount' bytes.
The return value should be tested if NULL.

*** WARNING *** :
        When _nc_doalloc() is used directly in source, the parameter
'amount'
        MUST correspond to the number of bytes needed (depend of the type).

        We assume 8-bits CHARS, 16-bits SHORTS, 32-bits INTS & LONGS.

        _nc_doalloc() MUST BE USED WITH sizeof() as typeRealloc is defined
        (or use typeRealloc only).
        The only problem I see is in hardscroll.c where typeRealloc() was
used
        with an integer. All others calls use 8-bits (1 byte) chars !!.


NCURSES_EXPORT (void *) _nc_doalloc (void *oldp, size_t amount)
{
    void *newp;

    if (oldp == 0) {  /* first allocation */
==>     if ((newp = (void *) malloc (amount)) == 0) {
==>         errno = ENOMEM;
        }
    }
    else {  /* reallocation */
        if ((newp = realloc (oldp, amount)) == 0) {
            free (oldp);
            errno = ENOMEM;  /* just in case 'free' reset */
        }
    }
    return (newp);
}

----------------------------------------------------------------------------
----
- Philippe