Segfault when terminal size > 100

[Eelco Dalhuisen]

Dear ncurses-people,

I wrote a little program for our shop where customers can check and 
place orders, which currently runs fine on a console computer. Now I have 
been asked to add some features to it, but suddenly the program segfaults 
at some point.

The curious part about these segfaults is that they are related to the 
terminal size. If the width of my terminal is exactly 100 or less (height 
doesn't matter), the program runs fine. However when I increase the 
terminal size beyond that, the program segfaults at several positions. See 
below for more information on those.

With all tests, I think the panel-library causes some form of memory 
corruption. I even got a function call to my log-function to loop 
indefinately (flooding my log file), and the statement after it never 
being executed. It stops after a while with yet another segfault.

The first version of the program still runs fine on a console of I think 
125 (some standard VESA size). I can't determine the ncurses-version 
running there right now, but it's at least 11 months old.

Hope this is of some help.

With regards,
Eelco



Testing details:

When I increase the size to 101, the program runs fine, but on exit when I 
unload all windows and panels, I get the following segfault:

*** glibc detected *** free(): invalid next size (fast): 0x0808def0 ***

With some logging enabled that address is the address of a panel, and the 
function causing it is del_panel(); This happens on the second window 
being unloaded.

When I keep increasing the window-size, the segfaults keep coming, but at 
different places. At times I get this error, which happens after all 
windows have been succesfully unloaded.

*** glibc detected *** free(): invalid next size (normal): 0x0808aa78 ***

That address is one of my own variables being freed. I admit it might be 
messy coding on my behalf, but it strikes me as odd it works fine at other 
times.

Finally, sometimes I get this error:
*** glibc detected *** malloc(): memory corruption: 0x0808ab48 ***
I can't really locate this one unfortunately, I've been unable to 
reproduce it so far.

When I increase the terminal size even more (110 now), I get a segfault
Segmentation fault (address 0xc (12): Address not mapped)
when calling redrawwin() on a window. After that it segfaults again when 
trying to delete a panel.

Size increased to 112, I get a segfault at address 0x0 when trying to 
waddnstr() to a window (the passed pointer isn't null), after which it 
segfaults again when trying to delete a window (after succesfully deleted 
a panel first).

When the terminal size further increases, all segfaults occur at the first 
waddnstr (just like above), with different non-null addresses depending on 
the terminal.


I run Gentoo on the develop computer, with:
- gcc 3.4.4
- glibc 2.3.5
- ncurses 5.4.20050319

Ncurses has been compiled with:
(with gentoo USEflags:
-bootstrap -build -debug -doc +gpm -minimal -nocxx -unicode)

--prefix=/usr --host=i686-pc-linux-gnu --mandir=/usr/share/man 
--infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc 
--localstatedir=/var/lib --build=i686-pc-linux-gnu --libdir=/lib 
--with-terminfo-dirs=/etc/terminfo:/usr/share/terminfo --disable-termcap 
--with-shared --with-rcs-ids --without-ada --enable-symlinks 
--program-prefix= --without-debug --with-gpm