Re: cooked-mode `wgetch()` stack off-by-one

Thomas Dickey <[email protected]> Thu, 14 May 2026 04:15:41 -0400

Newsgroups	gmane.comp.lib.ncurses.bugs
Message-ID	<[email protected]>

On Wed, May 13, 2026 at 09:51:11PM -0400, Daniel Anderson wrote:
> Good Evening,
> 
> I confirmed a stack overflow by compiling ncurses with ASAN enabled
> caused by the fact that wgetch() can write one byte past the stack buffer.
> I’d suggest fixing by allocating an extra byte for the terminator char
> buf[MAXCOLUMNS + 1].

actually this would be more consistent with the other calls to wgetnstr:

	    rc = wgetnstr(win, buf, MAXCOLUMNS - 1);

(thanks)

-- 
Thomas E. Dickey <[email protected]>
https://invisible-island.net

signature.asc (application/pgp-signature, 659 B)