You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add integer overflow guards to the curses chtype and color-pair packing path #152275
Some curses methods silently truncate a color pair or attributes that do not fit in a chtype, turning a range error into a wrong-rendering bug instead of an exception:
addch, addstr, addnstr, insch, insstr, insnstr, bkgd, bkgdset, echochar, hline, vline, box, border, attron, attroff, attrset and slk_attron/slk_attroff/slk_attrset take a raw long attr and narrow anything outside 0 .. 0xFFFFFFFF.
This is inconsistent with the rest of the module, which already raises rather than truncating: pair_converter (pair > INT_MAX/COLOR_PAIRS-1), component_converter (RGB outside 0..1000), attr_converter (gh-152219, value > (attr_t)-1) and curses_setcchar (pair beyond a short).
Activity
serhiy-storchaka commentedon Jun 26, 2026
I am not sure if it is worth to backport this change. @hugovk?
pythongh-152275: Initialize the optional attr argument to zero
pythongh-152275: Initialize the optional attr argument to zero
gh-152275: Add integer overflow guards to the curses chtype and color…
serhiy-storchaka commentedon Jun 28, 2026
Implemented in #152303 (merged).