From 845d924efb2a144120421260e62b9c4c9726fc69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Wed, 8 Jan 2025 14:55:04 +0100
Subject: gh-111178: fix UBSan failures in `Objects/capsule.c` (GH-128239)

fix UBSan failures for `PyCapsule`
---
 Objects/capsule.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/Objects/capsule.c b/Objects/capsule.c
index 28965e0..16ae659 100644
--- a/Objects/capsule.c
+++ b/Objects/capsule.c
@@ -18,6 +18,8 @@ typedef struct {
 } PyCapsule;
 
 
+#define _PyCapsule_CAST(op)     ((PyCapsule *)(op))
+
 
 static int
 _is_legal_capsule(PyObject *op, const char *invalid_capsule)
@@ -284,7 +286,7 @@ EXIT:
 static void
 capsule_dealloc(PyObject *op)
 {
-    PyCapsule *capsule = (PyCapsule *)op;
+    PyCapsule *capsule = _PyCapsule_CAST(op);
     PyObject_GC_UnTrack(op);
     if (capsule->destructor) {
         capsule->destructor(op);
@@ -296,7 +298,7 @@ capsule_dealloc(PyObject *op)
 static PyObject *
 capsule_repr(PyObject *o)
 {
-    PyCapsule *capsule = (PyCapsule *)o;
+    PyCapsule *capsule = _PyCapsule_CAST(o);
     const char *name;
     const char *quote;
 
@@ -314,28 +316,27 @@ capsule_repr(PyObject *o)
 
 
 static int
-capsule_traverse(PyCapsule *capsule, visitproc visit, void *arg)
+capsule_traverse(PyObject *self, visitproc visit, void *arg)
 {
     // Capsule object is only tracked by the GC
     // if _PyCapsule_SetTraverse() is called, but
     // this can still be manually triggered by gc.get_referents()
-
+    PyCapsule *capsule = _PyCapsule_CAST(self);
     if (capsule->traverse_func != NULL) {
-        return capsule->traverse_func((PyObject*)capsule, visit, arg);
+        return capsule->traverse_func(self, visit, arg);
     }
-
     return 0;
 }
 
 
 static int
-capsule_clear(PyCapsule *capsule)
+capsule_clear(PyObject *self)
 {
     // Capsule object is only tracked by the GC
     // if _PyCapsule_SetTraverse() is called
+    PyCapsule *capsule = _PyCapsule_CAST(self);
     assert(capsule->clear_func != NULL);
-
-    return capsule->clear_func((PyObject*)capsule);
+    return capsule->clear_func(self);
 }
 
 
@@ -358,8 +359,8 @@ PyTypeObject PyCapsule_Type = {
     .tp_dealloc = capsule_dealloc,
     .tp_repr = capsule_repr,
     .tp_doc = PyCapsule_Type__doc__,
-    .tp_traverse = (traverseproc)capsule_traverse,
-    .tp_clear = (inquiry)capsule_clear,
+    .tp_traverse = capsule_traverse,
+    .tp_clear = capsule_clear,
 };
 
 
-- 
cgit v0.12