From 799155dd84b1c73e4ff7c9561acf6375902b1a7f Mon Sep 17 00:00:00 2001 From: cwhite911 Date: Tue, 14 Jul 2026 10:37:08 -0400 Subject: [PATCH] libraries: Fix multiplications converted to a larger type Cast the first operand so that products assigned to or compared with size_t, ssize_t, long, and off_t values are computed in the wide type instead of int, which can overflow for large dimensions. This covers buffer sizes in the png and cairo drivers, gmath filter kernels, the ccmath calloc calls, linkm chunk allocation, raster row buffers, raster3d tile and volume sizes, segment addressing, and diglib reallocation. Fixes 24 CodeQL cpp/integer-multiplication-cast-to-long alerts. --- lib/cairodriver/draw_bitmap.c | 2 +- lib/cairodriver/graph.c | 3 ++- lib/external/ccmath/hmgen.c | 2 +- lib/external/ccmath/unitary.c | 2 +- lib/gmath/del2g.c | 4 ++-- lib/gmath/getg.c | 2 +- lib/linkm/new.c | 4 ++-- lib/pngdriver/graph_close.c | 3 ++- lib/pngdriver/graph_set.c | 6 ++++-- lib/raster/get_row.c | 4 ++-- lib/raster/put_row.c | 4 ++-- lib/raster3d/cache.c | 6 +++--- lib/raster3d/misc.c | 2 +- lib/raster3d/tilewrite.c | 4 ++-- lib/raster3d/volume.c | 3 ++- lib/segment/address.c | 2 +- lib/vector/diglib/allocation.c | 2 +- 17 files changed, 30 insertions(+), 25 deletions(-) diff --git a/lib/cairodriver/draw_bitmap.c b/lib/cairodriver/draw_bitmap.c index 25f21ddf231..f9948f9172a 100644 --- a/lib/cairodriver/draw_bitmap.c +++ b/lib/cairodriver/draw_bitmap.c @@ -38,7 +38,7 @@ void Cairo_Bitmap(int ncols, int nrows, int threshold, const unsigned char *buf) #define MULTIPLE 4 stride = (ncols + (MULTIPLE - 1)) / MULTIPLE * MULTIPLE; #endif - data = malloc(stride * nrows); + data = malloc((size_t)stride * nrows); surf = cairo_image_surface_create_for_data(data, CAIRO_FORMAT_A8, ncols, nrows, stride); diff --git a/lib/cairodriver/graph.c b/lib/cairodriver/graph.c index dadd40a176a..0bd9b356f6c 100644 --- a/lib/cairodriver/graph.c +++ b/lib/cairodriver/graph.c @@ -390,7 +390,8 @@ static int ends_with(const char *string, const char *suffix) static void map_file(void) { #ifndef _WIN32 - size_t size = HEADER_SIZE + ca.width * ca.height * sizeof(unsigned int); + size_t size = + HEADER_SIZE + (size_t)ca.width * ca.height * sizeof(unsigned int); void *ptr; int fd; diff --git a/lib/external/ccmath/hmgen.c b/lib/external/ccmath/hmgen.c index 2ebd566c0c8..8d2859e16b8 100644 --- a/lib/external/ccmath/hmgen.c +++ b/lib/external/ccmath/hmgen.c @@ -17,7 +17,7 @@ void hmgen(Cpx *h, double *ev, Cpx *u, int n) double e; - v = (Cpx *)calloc(n * n, sizeof(Cpx)); + v = (Cpx *)calloc((size_t)n * n, sizeof(Cpx)); cmcpy(v, u, n * n); hconj(v, n); for (i = 0, p = v; i < n; ++i) { diff --git a/lib/external/ccmath/unitary.c b/lib/external/ccmath/unitary.c index 2258a64692f..ec02fe1f76d 100644 --- a/lib/external/ccmath/unitary.c +++ b/lib/external/ccmath/unitary.c @@ -24,7 +24,7 @@ void unitary(Cpx *u, int n) double *g, *q, a; m = n * n; - g = (double *)calloc(n * n, sizeof(double)); + g = (double *)calloc((size_t)n * n, sizeof(double)); v = (Cpx *)calloc(m + n, sizeof(Cpx)); e = v + m; h.re = 1.; diff --git a/lib/gmath/del2g.c b/lib/gmath/del2g.c index a0e64846669..d1d02202c97 100644 --- a/lib/gmath/del2g.c +++ b/lib/gmath/del2g.c @@ -46,8 +46,8 @@ int del2g(double *img[2], int size, double w) G_message(_(" taking FFT of image...")); fft(FORWARD, img, size * size, size, size); - g[0] = (double *)G_malloc(size * size * sizeof(double)); - g[1] = (double *)G_malloc(size * size * sizeof(double)); + g[0] = (double *)G_malloc((size_t)size * size * sizeof(double)); + g[1] = (double *)G_malloc((size_t)size * size * sizeof(double)); G_message(_(" computing del**2 g...")); getg(w, g, size); diff --git a/lib/gmath/getg.c b/lib/gmath/getg.c index 58cca3d0403..bf2c0cc6cd3 100644 --- a/lib/gmath/getg.c +++ b/lib/gmath/getg.c @@ -17,7 +17,7 @@ int getg(double w, double *g[2], int size) long i, j, totsize, n, g_row; float rsq, sigma, two_ssq, val, sum = 0.0; - totsize = size * size; + totsize = (long)size * size; n = size / 2; for (i = 0; i < totsize; i++) { *(g[0] + i) = 0.0; diff --git a/lib/linkm/new.c b/lib/linkm/new.c index 3d6059b33a1..d6505c1f54a 100644 --- a/lib/linkm/new.c +++ b/lib/linkm/new.c @@ -32,8 +32,8 @@ VOID_T *link_new(struct link_head *Head) /*DEBUG fprintf (stderr, "Mallocing another chunk: %d\n", * Head->max_ptr); */ - if (NULL == - (tmp = (VOID_T *)malloc(Head->chunk_size * Head->unit_size))) { + if (NULL == (tmp = (VOID_T *)malloc((size_t)Head->chunk_size * + Head->unit_size))) { if (Head->exit_flag) link_out_of_memory(); return NULL; diff --git a/lib/pngdriver/graph_close.c b/lib/pngdriver/graph_close.c index e6dba3f6166..f446ee6c497 100644 --- a/lib/pngdriver/graph_close.c +++ b/lib/pngdriver/graph_close.c @@ -27,7 +27,8 @@ static void unmap_file(void) { - size_t size = HEADER_SIZE + png.width * png.height * sizeof(unsigned int); + size_t size = + HEADER_SIZE + (size_t)png.width * png.height * sizeof(unsigned int); void *ptr = (char *)png.grid - HEADER_SIZE; if (!png.mapped) diff --git a/lib/pngdriver/graph_set.c b/lib/pngdriver/graph_set.c index ab0bacbff38..c448bd62bff 100644 --- a/lib/pngdriver/graph_set.c +++ b/lib/pngdriver/graph_set.c @@ -33,7 +33,8 @@ struct png_state png; static void map_file(void) { - size_t size = HEADER_SIZE + png.width * png.height * sizeof(unsigned int); + size_t size = + HEADER_SIZE + (size_t)png.width * png.height * sizeof(unsigned int); void *ptr; int fd; @@ -158,7 +159,8 @@ int PNG_Graph_set(void) map_file(); if (!png.mapped) - png.grid = G_malloc(png.width * png.height * sizeof(unsigned int)); + png.grid = + G_malloc((size_t)png.width * png.height * sizeof(unsigned int)); if (!do_read) { PNG_Erase(); diff --git a/lib/raster/get_row.c b/lib/raster/get_row.c index 066b3c9a3e8..5fddb183900 100644 --- a/lib/raster/get_row.c +++ b/lib/raster/get_row.c @@ -90,7 +90,7 @@ static void read_data_fp_compressed(int fd, int row, unsigned char *data_buf, off_t t1 = fcb->row_ptr[row]; off_t t2 = fcb->row_ptr[row + 1]; size_t readamount = t2 - t1; - size_t bufsize = fcb->cellhd.cols * fcb->nbytes; + size_t bufsize = (size_t)fcb->cellhd.cols * fcb->nbytes; int ret; if (lseek(fcb->data_fd, t1, SEEK_SET) == -1) @@ -188,7 +188,7 @@ static void read_data_uncompressed(int fd, int row, unsigned char *data_buf, int *nbytes) { struct fileinfo *fcb = &R__.fileinfo[fd]; - ssize_t bufsize = fcb->cellhd.cols * fcb->nbytes; + ssize_t bufsize = (ssize_t)fcb->cellhd.cols * fcb->nbytes; *nbytes = fcb->nbytes; diff --git a/lib/raster/put_row.c b/lib/raster/put_row.c index b3c870045d0..19c31158ede 100644 --- a/lib/raster/put_row.c +++ b/lib/raster/put_row.c @@ -115,7 +115,7 @@ void Rast_put_d_row(int fd, const DCELL *buf) static void write_data(int fd, int row, unsigned char *buf, int n) { struct fileinfo *fcb = &R__.fileinfo[fd]; - ssize_t nwrite = fcb->nbytes * n; + ssize_t nwrite = (ssize_t)fcb->nbytes * n; if (write(fcb->data_fd, buf, nwrite) != nwrite) G_fatal_error( @@ -411,7 +411,7 @@ static void put_data(int fd, char *null_buf, const CELL *cell, int row, int n, G_free(compressed_buf); } else { - nwrite = fcb->nbytes * n; + nwrite = (ssize_t)fcb->nbytes * n; if (write(fcb->data_fd, work_buf, nwrite) != nwrite) G_fatal_error( diff --git a/lib/raster3d/cache.c b/lib/raster3d/cache.c index aa28845f546..4a4b3ee7edc 100644 --- a/lib/raster3d/cache.c +++ b/lib/raster3d/cache.c @@ -75,7 +75,7 @@ static int cacheWrite_readFun(int tileIndex, void *tileBuf, void *closure) pos = -pos - 2; /* pos is shifted by 2 to avoid 0 and -1 */ - nBytes = map->tileSize * map->numLengthIntern; + nBytes = (size_t)map->tileSize * map->numLengthIntern; offs = pos * (nBytes + sizeof(int)); /* seek tile and read it into buffer */ @@ -149,7 +149,7 @@ static int cacheWrite_writeFun(int tileIndex, const void *tileBuf, return 1; map->cachePosLast++; - nBytes = map->tileSize * map->numLengthIntern; + nBytes = (size_t)map->tileSize * map->numLengthIntern; offs = map->cachePosLast * (nBytes + sizeof(int)); if (lseek(map->cacheFD, offs, SEEK_SET) == -1) { @@ -299,7 +299,7 @@ int Rast3d_flush_all_tiles(RASTER3D_Map *map) /* first flush all the tiles which are in the file cache */ - nBytes = map->tileSize * map->numLengthIntern; + nBytes = (size_t)map->tileSize * map->numLengthIntern; while (map->cachePosLast >= 0) { offs = map->cachePosLast * (nBytes + sizeof(int)) + nBytes; diff --git a/lib/raster3d/misc.c b/lib/raster3d/misc.c index 599d409e1e3..de69881c9bc 100644 --- a/lib/raster3d/misc.c +++ b/lib/raster3d/misc.c @@ -67,7 +67,7 @@ void Rast3d_copy_values(const void *src, int offsSrc, int typeSrc, void *dst, src = G_incr_void_ptr(src, eltLength * offsSrc); dst = G_incr_void_ptr(dst, eltLength * offsDst); - memcpy(dst, src, nElts * eltLength); + memcpy(dst, src, (size_t)nElts * eltLength); } /*---------------------------------------------------------------------------*/ diff --git a/lib/raster3d/tilewrite.c b/lib/raster3d/tilewrite.c index 6239a6a9852..6f2c646c5d0 100644 --- a/lib/raster3d/tilewrite.c +++ b/lib/raster3d/tilewrite.c @@ -73,8 +73,8 @@ static int Rast3d_tile2xdrTile(RASTER3D_Map *map, const void *tile, int rows, static int Rast3d_writeTileUncompressed(RASTER3D_Map *map, int nofNum) { - if (write(map->data_fd, xdr, map->numLengthExtern * nofNum) != - map->numLengthExtern * nofNum) { + if (write(map->data_fd, xdr, (size_t)map->numLengthExtern * nofNum) != + (ssize_t)map->numLengthExtern * nofNum) { Rast3d_error("Rast3d_writeTileUncompressed: can't write file."); return 0; } diff --git a/lib/raster3d/volume.c b/lib/raster3d/volume.c index 491fae84c6b..b33337ecb7e 100644 --- a/lib/raster3d/volume.c +++ b/lib/raster3d/volume.c @@ -202,7 +202,8 @@ void Rast3d_make_aligned_volume_file(void *map, const char *fileName, int x, y, z, eltLength; RASTER3D_Region region; - volumeBuf = Rast3d_malloc(nx * ny * nz * sizeof(Rast3d_get_file_type())); + volumeBuf = + Rast3d_malloc((size_t)nx * ny * nz * sizeof(Rast3d_get_file_type())); if (volumeBuf == NULL) Rast3d_fatal_error( "Rast3d_make_aligned_volume_file: error in Rast3d_malloc"); diff --git a/lib/segment/address.c b/lib/segment/address.c index 7562467f5b0..a917d1bf40f 100644 --- a/lib/segment/address.c +++ b/lib/segment/address.c @@ -85,7 +85,7 @@ int seg_address_slow(const SEGMENT *SEG, off_t row, off_t col, int *n, /* for simple arrays */ else { *n = col / SEG->scols; - *index = col - *n * SEG->scols; + *index = col - (off_t)*n * SEG->scols; } *index *= SEG->len; diff --git a/lib/vector/diglib/allocation.c b/lib/vector/diglib/allocation.c index d2fb62a36d3..b5f6cfaaa7b 100644 --- a/lib/vector/diglib/allocation.c +++ b/lib/vector/diglib/allocation.c @@ -151,7 +151,7 @@ void *dig__frealloc(void *oldptr, int nelem, int elsize, int oldnelem) register char *b; register size_t n; - n = oldnelem * elsize; + n = (size_t)oldnelem * elsize; a = ptr; b = oldptr; while (n--)