newwin() in curses has a bug

utzoo!decvax!pur-ee!purdue!rlb utzoo!decvax!pur-ee!purdue!rlb
Sat Jul 31 04:10:36 AEST 1982


In the curses package in 4.1bsd, the newwin routine allocates storage
for a new window and initializes the fields in the window structure.
newwin() uses calloc() for most of the allocation, which guarantees
that the allocated storage will be zeroed.  However, it uses malloc()
for the window structure itself and malloc doesn't guarantee zeroes.

The problem is with the _flag field in the structure - it's a bit
vector.  The only operations on that field are oring in and anding
out bits - never is the field ever initialized to zero.  This causes
problems if the allocated word for the _flag field has STANDOUT or
other bothersome bits turned on initially.

FIX: insert the following line immediately after the call to malloc
in makenew() in newwin.c:

	win->_flags = 0

Bob Brown (rlb)
Purdue-CS (317) 494-6530



More information about the Comp.bugs.4bsd.ucb-fixes mailing list