[3.13] gh-156946: Unlink a curses panel before dropping its user pointer (GH-156947) (GH-157542)

A __del__ of the user pointer could get the panel being deallocated
from top_panel() and crash the interpreter.
(cherry picked from commit df02e26)

Co-authored-by: Vyron Vasileiadis <hi@fedonman.com>

Author: serhiy-storchaka

Lib/test/test_curses.py

@@ -1379,6 +1379,22 @@ def __del__(self):
         panel.set_userptr(A())
         panel.set_userptr(None)
 
+    @requires_curses_func('panel')
+    def test_userptr_dealloc_segfault(self):
+        w = curses.newwin(10, 10)
+        panel = curses.panel.new_panel(w)
+        seen = []
+        class A:
+            def __del__(self):
+                # The panel is being deallocated, so it must already be off
+                # the stack: handing it back here would resurrect an object
+                # whose refcount is zero -- segfaults.
+                seen.append(curses.panel.top_panel() is None)
+        panel.set_userptr(A())
+        del panel
+        gc_collect()
+        self.assertEqual(seen, [True])
+
     @cpython_only
     @requires_curses_func('panel')
     def test_disallow_instantiation(self):

Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst

@@ -0,0 +1,3 @@
+Fix a crash in :mod:`curses.panel` when the finalizer of a panel's user
+pointer runs while the panel is being deallocated.  The panel is now taken
+off the panel stack before its user pointer is dropped.

Modules/_curses_panel.c

@@ -311,13 +311,13 @@ PyCursesPanel_Clear(PyObject *op)
     PyCursesPanelObject *self = _PyCursesPanelObject_CAST(op);
     PyObject *extra = (PyObject *)panel_userptr(self->pan);
     if (extra != NULL) {
-        Py_DECREF(extra);
         if (set_panel_userptr(self->pan, NULL) == ERR) {
             _curses_panel_state *state = get_curses_panel_state_by_panel(self);
             PyErr_SetString(state->PyCursesError,
                             "set_panel_userptr() returned ERR");
             return -1;
         }
+        Py_DECREF(extra);
     }
     // self->wo should not be cleared because an associated WINDOW may exist
     return 0;
@@ -330,18 +330,26 @@ PyCursesPanel_Dealloc(PyObject *self)
     PyObject_GC_UnTrack(self);
 
     PyCursesPanelObject *po = _PyCursesPanelObject_CAST(self);
-    if (PyCursesPanel_Clear(self) < 0) {
+    PyObject *extra = (PyObject *)panel_userptr(po->pan);
+    if (extra != NULL && set_panel_userptr(po->pan, NULL) == ERR) {
+        _curses_panel_state *state = get_curses_panel_state_by_panel(po);
+        PyErr_SetString(state->PyCursesError,
+                        "set_panel_userptr() returned ERR");
         PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()");
     }
+    if (po->wo != NULL) {
+        remove_lop(po);
+        if (PyErr_Occurred()) {
+            PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()");
+        }
+    }
     if (del_panel(po->pan) == ERR && !PyErr_Occurred()) {
         _curses_panel_state *state = get_curses_panel_state_by_panel(po);
         PyErr_SetString(state->PyCursesError, "del_panel() returned ERR");
         PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()");
     }
-    if (po->wo != NULL) {
-        Py_DECREF(po->wo);
-        remove_lop(po);
-    }
+    Py_XDECREF(extra);
+    Py_XDECREF(po->wo);
     tp->tp_free(po);
     Py_DECREF(tp);
 }