[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Critical bug in ncurses 6.0

From: Johannes Schindelin
Subject: Re: Critical bug in ncurses 6.0
Date: Sat, 27 Jun 2015 09:31:16 +0200
User-agent: Roundcube Webmail/1.1.0

Hi Thomas,

On 2015-06-27 01:19, Thomas Dickey wrote:
On Fri, Jun 26, 2015 at 03:47:44PM +0200, Johannes Schindelin wrote:

I believe I found a really awful bug in ncurses 6.0-20150613: when

for the record, it's still a pre-release (thanks for the feedback)

Right. However, it is already used by MSys2, which in turn forms the basis of Git for Windows 2.x (hopefully to be released officially Real Soon Now).

TERM is set to a value that does not correspond to a subdirectory in

The reason is that the `drv_CanHandle()` function in
`ncurses/tinfo/tinfo_driver.c` wants to return a `bool`, but reuses
the `ret_error*()` functions from `ncurses/curses.priv.h` that
returns `ERR` which is (-1) and is mapped to `TRUE`!!!

As a consequence, the driver is used by mistake in
`_nc_get_driver()` in `ncurses/base/lib_driver.c` and uses `free()`d
data (by continuing to use the `termp` variable that no longer
points at allocated memory!).

This causes a crash in Git for Windows 2.x (which I am maintaining)
when calling Bash with an unknown `TERM` value.

Please consider the following patch, which is also available on
GitHub (because my mail program will most likely corrupt the patch): https://raw.githubusercontent.com/git-for-windows/MSYS2-packages/fix-ncurses-crash/ncurses/0001-CRITICAL-fix-return-value-of-drv_CanHandle-on-unknow.patch

-- snipsnap --
From 41f152b6e8bea7e92be960158ef4bd9df34dd8a0 Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <address@hidden>
Date: Fri, 26 Jun 2015 13:19:49 +0000
Subject: [PATCH] CRITICAL: fix return value of drv_CanHandle on unknown

By mistake, the 5.9 -> 6.0 patches tried to reuse the `ret_error*()`
functions in both lib_driver.c and tinfo_driver.c. However, in the

I see that was from

        + double-check gn (generic) flag in terminal descriptions to
          accommodate old/buggy termcap databases which misused that feature.

Do you have a source code repository with revisions anywhere so I can pick up your fix (if you fix it differently from my work-around)?


reply via email to

[Prev in Thread] Current Thread [Next in Thread]