bpo-27666: Fixed stack corruption in curses.box() and curses.ungetmouse(). (#4220)
diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c
index 1f6897a..ae1905b 100644
--- a/Modules/_cursesmodule.c
+++ b/Modules/_cursesmodule.c
@@ -911,12 +911,19 @@
static PyObject *
PyCursesWindow_Box(PyCursesWindowObject *self, PyObject *args)
{
+ PyObject *temp1, *temp2;
chtype ch1=0,ch2=0;
switch(PyTuple_Size(args)){
case 0: break;
default:
- if (!PyArg_ParseTuple(args,"ll;vertint,horint", &ch1, &ch2))
+ if (!PyArg_ParseTuple(args,"OO;verch,horch", &temp1, &temp2))
return NULL;
+ if (!PyCurses_ConvertToChtype(self, temp1, &ch1)) {
+ return NULL;
+ }
+ if (!PyCurses_ConvertToChtype(self, temp2, &ch2)) {
+ return NULL;
+ }
}
box(self->win,ch1,ch2);
Py_RETURN_NONE;
@@ -2268,24 +2275,30 @@
PyErr_SetString(PyCursesError, "getmouse() returned ERR");
return NULL;
}
- return Py_BuildValue("(hiiil)",
+ return Py_BuildValue("(hiiik)",
(short)event.id,
- event.x, event.y, event.z,
- (long) event.bstate);
+ (int)event.x, (int)event.y, (int)event.z,
+ (unsigned long) event.bstate);
}
static PyObject *
PyCurses_UngetMouse(PyObject *self, PyObject *args)
{
MEVENT event;
+ short id;
+ int x, y, z;
+ unsigned long bstate;
PyCursesInitialised;
- if (!PyArg_ParseTuple(args, "hiiil",
- &event.id,
- &event.x, &event.y, &event.z,
- (int *) &event.bstate))
+ if (!PyArg_ParseTuple(args, "hiiik",
+ &id, &x, &y, &z, &bstate))
return NULL;
+ event.id = id;
+ event.x = x;
+ event.y = y;
+ event.z = z;
+ event.bstate = bstate;
return PyCursesCheckERR(ungetmouse(&event), "ungetmouse");
}
#endif
@@ -2669,14 +2682,15 @@
static PyObject *
PyCurses_MouseMask(PyObject *self, PyObject *args)
{
- int newmask;
+ unsigned long newmask;
mmask_t oldmask, availmask;
PyCursesInitialised;
- if (!PyArg_ParseTuple(args,"i;mousemask",&newmask))
+ if (!PyArg_ParseTuple(args,"k;mousemask",&newmask))
return NULL;
- availmask = mousemask(newmask, &oldmask);
- return Py_BuildValue("(ll)", (long)availmask, (long)oldmask);
+ availmask = mousemask((mmask_t)newmask, &oldmask);
+ return Py_BuildValue("(kk)",
+ (unsigned long)availmask, (unsigned long)oldmask);
}
#endif