gh-154781: Zero the in_wstr() buffer in curses

winnwstr() only writes the terminating null when it stored at least one
character, so with n of 0 the result was read from uninitialized memory. Use
PyMem_Calloc, like in_wchstr() already does.

Author: fedonman

Lib/test/test_curses.py

@@ -514,6 +514,12 @@ def test_in_wstr(self):
                     self.assertEqual(stdscr.in_wstr(0, 0, len(s)), s)
                     self.assertIsInstance(stdscr.instr(0, 0, len(s)), bytes)
 
+        # Reading no characters gives an empty string, like instr() and
+        # in_wchstr() do.  curses does not terminate the buffer in this case.
+        stdscr.addstr(0, 0, 'abz')
+        self.assertEqual(stdscr.in_wstr(0, 0, 0), '')
+        self.assertEqual(stdscr.in_wstr(0), '')
+
     def test_complexchar(self):
         # A complexchar is a styled wide-character cell: str() is its text,
         # and the attr and pair attributes are its rendition.

Modules/_cursesmodule.c

@@ -3850,7 +3850,9 @@ PyCursesWindow_in_wstr(PyObject *op, PyObject *args)
     }
 
     n = Py_MIN(n, max_buf_size - 1);
-    wchar_t *buf = PyMem_New(wchar_t, n + 1);
+    /* Zero the buffer: winnwstr() only writes the terminating null when it
+       stored at least one character, and the result is read up to it. */
+    wchar_t *buf = PyMem_Calloc(n + 1, sizeof(wchar_t));
     if (buf == NULL) {
         return PyErr_NoMemory();
     }