From 44ab80b9a79e286690ef6dd97d916d5e4195ded3 Mon Sep 17 00:00:00 2001 From: Vyron Vasileiadis Date: Fri, 4 Sep 2026 19:06:04 +0300 Subject: [PATCH 1/2] gh-156946: Unlink a curses panel before dropping its user pointer PyCursesPanel_Dealloc() dropped the panel's user pointer first, through PyCursesPanel_Clear(), and only then called del_panel() and remove_lop(). Dropping that reference can run a __del__, and until del_panel() has run the dying panel is still on the panel stack and still in lop, so top_panel(), bottom_panel(), above() and below() hand the finalizer a new reference to an object whose refcount is already zero. Releasing that reference re-enters the deallocator and the interpreter segfaults. Take the panel out of lop and off the panel stack first, and release the user pointer and the window afterwards. set_panel_userptr() and panel_userptr() need the PANEL, so they still run before del_panel(). remove_lop() now also runs before del_panel(), which closes a second window where the registry held an entry whose PANEL had been freed. The deallocator cannot simply call PyCursesPanel_Clear() in the new order because that function is also tp_clear, where del_panel() must not run. --- Lib/test/test_curses.py | 16 ++++++++++++++++ ...26-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst | 3 +++ Modules/_curses_panel.c | 17 +++++++++-------- 3 files changed, 28 insertions(+), 8 deletions(-) create mode 100644 Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst diff --git a/Lib/test/test_curses.py b/Lib/test/test_curses.py index 389cd043d6c0f3..e847c13f12432f 100644 --- a/Lib/test/test_curses.py +++ b/Lib/test/test_curses.py @@ -2428,6 +2428,22 @@ def __del__(self): panel.set_userptr(A()) panel.set_userptr(None) + @requires_curses_func('panel') + def test_userptr_dealloc_segfault(self): + w = curses.newwin(10, 10) + panel = curses.panel.new_panel(w) + seen = [] + class A: + def __del__(self): + # The panel is being deallocated, so it must already be off + # the stack: handing it back here would resurrect an object + # whose refcount is zero -- segfaults. + seen.append(curses.panel.top_panel() is None) + panel.set_userptr(A()) + del panel + gc_collect() + self.assertEqual(seen, [True]) + @cpython_only @requires_curses_func('panel') def test_disallow_instantiation(self): diff --git a/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst b/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst new file mode 100644 index 00000000000000..5b72fd3561e804 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst @@ -0,0 +1,3 @@ +Fix a crash in :mod:`curses.panel` when the finalizer of a panel's user +pointer runs while the panel is being deallocated. The panel is now taken +off the panel stack before its user pointer is dropped. diff --git a/Modules/_curses_panel.c b/Modules/_curses_panel.c index 78d7bf7c263646..02bd4ce30b02b7 100644 --- a/Modules/_curses_panel.c +++ b/Modules/_curses_panel.c @@ -454,20 +454,21 @@ PyCursesPanel_Dealloc(PyObject *self) PyObject_GC_UnTrack(self); PyCursesPanelObject *po = _PyCursesPanelObject_CAST(self); - if (PyCursesPanel_Clear(self) < 0) { + PyObject *extra = (PyObject *)panel_userptr(po->pan); + if (extra != NULL && set_panel_userptr(po->pan, NULL) == ERR) { + curses_panel_panel_set_error(po, "set_panel_userptr", "__del__"); + PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()"); + } + if (po->wo != NULL && remove_lop(po) < 0) { + PyErr_SetString(PyExc_RuntimeError, "__del__: no panel object to delete"); PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()"); } if (del_panel(po->pan) == ERR && !PyErr_Occurred()) { curses_panel_panel_set_error(po, "del_panel", "__del__"); PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()"); } - if (po->wo != NULL) { - Py_DECREF(po->wo); - if (remove_lop(po) < 0) { - PyErr_SetString(PyExc_RuntimeError, "__del__: no panel object to delete"); - PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()"); - } - } + Py_XDECREF(extra); + Py_XDECREF(po->wo); tp->tp_free(po); Py_DECREF(tp); } From 889a3212eb72ba5e5deddca0461b40a96bf58419 Mon Sep 17 00:00:00 2001 From: Vyron Vasileiadis Date: Sun, 13 Sep 2026 23:07:18 -0400 Subject: [PATCH 2/2] Drop the user pointer reference after unlinking it in tp_clear PyCursesPanel_Clear() released the user pointer before clearing it from the panel, leaving the panel pointing at an object whose refcount could reach zero. Same ordering as the deallocator. --- Modules/_curses_panel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Modules/_curses_panel.c b/Modules/_curses_panel.c index 02bd4ce30b02b7..40d407742b1621 100644 --- a/Modules/_curses_panel.c +++ b/Modules/_curses_panel.c @@ -437,11 +437,11 @@ PyCursesPanel_Clear(PyObject *op) PyCursesPanelObject *self = _PyCursesPanelObject_CAST(op); PyObject *extra = (PyObject *)panel_userptr(self->pan); if (extra != NULL) { - Py_DECREF(extra); if (set_panel_userptr(self->pan, NULL) == ERR) { curses_panel_panel_set_error(self, "set_panel_userptr", NULL); return -1; } + Py_DECREF(extra); } // self->wo should not be cleared because an associated WINDOW may exist return 0;