NetBSD Problem Report #55484

From www@netbsd.org  Sun Jul 12 17:12:44 2020
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 563A91A9213
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 12 Jul 2020 17:12:44 +0000 (UTC)
Message-Id: <20200712171243.6332A1A921A@mollari.NetBSD.org>
Date: Sun, 12 Jul 2020 17:12:43 +0000 (UTC)
From: jnaman806@gmail.com
Reply-To: jnaman806@gmail.com
To: gnats-bugs@NetBSD.org
Subject: [libcurses] newwin() results into seg fault
X-Send-Pr-Version: www-1.0

>Number:         55484
>Category:       lib
>Synopsis:       [libcurses] newwin() results into seg fault
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 12 17:15:00 +0000 2020
>Closed-Date:    Wed Jul 15 00:56:21 +0000 2020
>Last-Modified:  Wed Jul 15 00:56:21 +0000 2020
>Originator:     Naman Jain
>Release:        NetBSD 9.0
>Organization:
IIT Kanpur
>Environment:
NetBSD localhost 9.0 NetBSD 9.0 (GENERIC) #0: Fri Feb 14 00:06:28 UTC 2020  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
newwin() results in segfault for the negative value of 'cols'. 
From the man pages:
"Similarly if cols is less than or equal to zero then the number of columns for the window is set to COLS - begin_y + cols."

Consider newwin(0,-1,0,0), it is expected to create a window of LINES-1 lines and COLS-1 cols. But it results into segfault. 
>How-To-Repeat:

>Fix:

>Release-Note:

>Audit-Trail:
From: Valery Ushakov <uwe@stderr.spb.ru>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: lib/55484: [libcurses] newwin() results into seg fault
Date: Tue, 14 Jul 2020 07:31:30 +0300

 This seems to have been introduced in newwin.c revision 1.34 when
 support for -ve numbers was added, but one s/ncols/maxx/ edit was
 missed.

 -uwe

From: "Valeriy E. Ushakov" <uwe@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/55484 CVS commit: src/lib/libcurses
Date: Tue, 14 Jul 2020 04:39:39 +0000

 Module Name:	src
 Committed By:	uwe
 Date:		Tue Jul 14 04:39:39 UTC 2020

 Modified Files:
 	src/lib/libcurses: newwin.c

 Log Message:
 newwin - fix crash with negative ncols.

 When support for negative nrows/ncols was added, one s/ncols/maxx/ was
 missed so we ended up passing negative (i.e. huge unsigned) length
 when hashing the line contents.

 Reported by Naman Jain in PR lib/55484


 To generate a diff of this commit:
 cvs rdiff -u -r1.57 -r1.58 src/lib/libcurses/newwin.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/55484 CVS commit: [netbsd-9] src/lib/libcurses
Date: Tue, 14 Jul 2020 13:37:18 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Tue Jul 14 13:37:18 UTC 2020

 Modified Files:
 	src/lib/libcurses [netbsd-9]: newwin.c

 Log Message:
 Pull up following revision(s) (requested by uwe in ticket #1004):

 	lib/libcurses/newwin.c: revision 1.58

 newwin - fix crash with negative ncols.

 When support for negative nrows/ncols was added, one s/ncols/maxx/ was
 missed so we ended up passing negative (i.e. huge unsigned) length
 when hashing the line contents.

 Reported by Naman Jain in PR lib/55484


 To generate a diff of this commit:
 cvs rdiff -u -r1.57 -r1.57.2.1 src/lib/libcurses/newwin.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/55484 CVS commit: [netbsd-8] src/lib/libcurses
Date: Tue, 14 Jul 2020 13:39:09 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Tue Jul 14 13:39:09 UTC 2020

 Modified Files:
 	src/lib/libcurses [netbsd-8]: newwin.c

 Log Message:
 Pull up following revision(s) (requested by uwe in ticket #1574):

 	lib/libcurses/newwin.c: revision 1.58

 newwin - fix crash with negative ncols.

 When support for negative nrows/ncols was added, one s/ncols/maxx/ was
 missed so we ended up passing negative (i.e. huge unsigned) length
 when hashing the line contents.

 Reported by Naman Jain in PR lib/55484


 To generate a diff of this commit:
 cvs rdiff -u -r1.50.6.3 -r1.50.6.4 src/lib/libcurses/newwin.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: uwe@NetBSD.org
State-Changed-When: Wed, 15 Jul 2020 00:56:21 +0000
State-Changed-Why:
Fixed on all supported branches.
Thanks!


>Unformatted:

Home	PR Database Search