From fa987dc05903e12e4d799fa154cace1ec7bbc63d Mon Sep 17 00:00:00 2001 From: Jesse Yurkovich Date: Thu, 12 Oct 2023 07:44:13 +0200 Subject: [PATCH] Fix #110524: Use correct typed API to retrieve python GPU buffer sizes Large GPU buffers can overflow their dimension property due to the use of `PyLong_AsLong` instead of `PyLong_AsSsize_t` when processing the buffer shape. Pull Request: https://projects.blender.org/blender/blender/pulls/113566 --- source/blender/python/gpu/gpu_py_buffer.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source/blender/python/gpu/gpu_py_buffer.cc b/source/blender/python/gpu/gpu_py_buffer.cc index a0aa7ebfc74..28fa29fd8fe 100644 --- a/source/blender/python/gpu/gpu_py_buffer.cc +++ b/source/blender/python/gpu/gpu_py_buffer.cc @@ -64,7 +64,7 @@ static bool pygpu_buffer_pyobj_as_shape(PyObject *shape_obj, Py_ssize_t shape_len = 0; if (PyLong_Check(shape_obj)) { shape_len = 1; - if ((r_shape[0] = PyLong_AsLong(shape_obj)) < 1) { + if ((r_shape[0] = PyLong_AsSsize_t(shape_obj)) < 1) { PyErr_SetString(PyExc_AttributeError, "dimension must be greater than or equal to 1"); return false; } @@ -92,7 +92,7 @@ static bool pygpu_buffer_pyobj_as_shape(PyObject *shape_obj, return false; } - r_shape[i] = PyLong_AsLong(ob); + r_shape[i] = PyLong_AsSsize_t(ob); Py_DECREF(ob); if (r_shape[i] < 1) {