From ba5d5b30bac31b84f5fb420f7b3bb99e2c486d50 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Thu, 1 Dec 2022 14:07:58 +0100 Subject: [PATCH] gh-99845: _PyObject_DictPointer(): fix dictoffset cast (GH-99922) Cast size_t to Py_ssize_t, rather than casting it to long. On 64-bit Windows, long is 32-bit whereas Py_ssize_t is 64-bit. (cherry picked from commit 9707bf228e008485a3fbb63aa7ee28cf88014f91) Co-authored-by: Victor Stinner --- Objects/object.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Objects/object.c b/Objects/object.c index 6d80d6df741031..0bef2e9dfb5e35 100644 --- a/Objects/object.c +++ b/Objects/object.c @@ -1091,8 +1091,9 @@ _PyObject_GetDictPtr(PyObject *obj) tsize = -tsize; } size_t size = _PyObject_VAR_SIZE(tp, tsize); + assert(size <= (size_t)PY_SSIZE_T_MAX); + dictoffset += (Py_ssize_t)size; - dictoffset += (long)size; _PyObject_ASSERT(obj, dictoffset > 0); _PyObject_ASSERT(obj, dictoffset % SIZEOF_VOID_P == 0); }