Skip to content

Fix buffer overflow in TIOCGWINSZ ioctl for Python 3.14+#20

Merged
Snaipe merged 1 commit intoSnaipe:masterfrom
przadka:fix-buffer-overflow-python-3.14
Jan 7, 2026
Merged

Fix buffer overflow in TIOCGWINSZ ioctl for Python 3.14+#20
Snaipe merged 1 commit intoSnaipe:masterfrom
przadka:fix-buffer-overflow-python-3.14

Conversation

@przadka
Copy link
Copy Markdown
Contributor

@przadka przadka commented Nov 24, 2025

Fixes #18

Problem

Python 3.14 introduced stricter buffer validation for ioctl calls. The current code passes a 4-byte buffer to TIOCGWINSZ, but it expects struct winsize (4 unsigned shorts = 8 bytes). This causes SystemError on Python 3.14+.

Solution

  • Increase buffer from 4 to 8 bytes
  • Update struct format from "hh" to "hhhh"
  • Unpack all 4 values but only use first 2 (rows, columns)

This matches the fix used by PyInvoke: pyinvoke/invoke#1040

Testing

Tested on Python 3.14 with B2 CLI which depends on rst2ansi.

TIOCGWINSZ ioctl expects struct winsize which contains 4 unsigned shorts
(8 bytes total), not 2. Python 3.14 introduced stricter buffer validation
that detects this mismatch and raises SystemError.

Changes:
- Increase buffer size from 4 to 8 bytes (b"\x00" * 4 -> b"\x00" * 8)
- Update struct format from "hh" to "hhhh" to unpack all 4 shorts
- Unpack all values but only use first two (rows, columns)

Fixes #18
@Snaipe
Copy link
Copy Markdown
Owner

Snaipe commented Jan 7, 2026

Sorry for the delay; thanks for the fix!

@Snaipe Snaipe merged commit 3728e16 into Snaipe:master Jan 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

get_terminal_size incorrectly passes a 4 byte buffer for termios.TIOCGWINSZ

2 participants