gh-155875: Fix new_prescr screen lifetime

[BHUVANSH855]

Summary

Fixes a use-after-free when curses.new_prescr() is followed by initscr() or newterm().

The pending pre-screen is now tracked by the curses module and its ownership is transferred when the screen is adopted, preventing the new_prescr() wrapper from deleting a live SCREEN.

Fixes issue gh-155875

[serhiy-storchaka]

The fix works for the reported case, but the ownership model is incomplete: the ncurses new_prescr() returns the same pending SCREEN on every call until initscr()/newterm() consumes it. So after pre1 = curses.new_prescr(); pre2 = curses.new_prescr() two objects own one screen; when pre1 is deleted it still calls delscreen() on it, pre2 keeps a dangling pointer, and the assertion in newterm() only holds if the next allocation reuses the address. new_prescr() should return the existing object while state->prescreen still owns a screen, so that exactly one object owns it.

new_prescr() is new in 3.16, so no NEWS entry is needed (skip news).

test_initscr_after_new_prescr_keeps_screen_alive calls initscr() on the real stdout; see how TestCurses.setUp() redirects it.

[serhiy-storchaka]

Thanks, the ownership is right now, and it is clean under -R 3:3.

One thing left: test_initscr_after_new_prescr_keeps_screen_alive still runs initscr() on the real stdout, so its escape sequences end up in the test output. Redirect fd 1 to a pty for the duration of the test:

        s = self.make_pty()
        saved = os.dup(1)
        self.addCleanup(os.close, saved)
        self.addCleanup(os.dup2, saved, 1)
        os.dup2(s, 1)

With that it can be merged.

[BHUVANSH855]

Thanks, the ownership is right now, and it is clean under -R 3:3.

One thing left: test_initscr_after_new_prescr_keeps_screen_alive still runs initscr() on the real stdout, so its escape sequences end up in the test output. Redirect fd 1 to a pty for the duration of the test:

        s = self.make_pty()
        saved = os.dup(1)
        self.addCleanup(os.close, saved)
        self.addCleanup(os.dup2, saved, 1)
        os.dup2(s, 1)

With that it can be merged.

done

[serhiy-storchaka]

LGTM. 👍