From 6a4185cf0e1a1e67f2000f77d7a5af41e72131bb Mon Sep 17 00:00:00 2001 From: cwhite911 Date: Tue, 14 Jul 2026 10:43:42 -0400 Subject: [PATCH 1/2] raster: Fix multiplications converted to a larger type Cast the first operand so that integer products used as allocation sizes, file offsets, and pointer offsets are computed in size_t, off_t, or the destination integer type instead of int, and so that float products consumed as double (exp, log2, sin arguments and double variables) are computed in double. Fixes 36 CodeQL cpp/integer-multiplication-cast-to-long alerts in 15 raster tools. --- raster/r.basins.fill/read_map.c | 2 +- raster/r.distance/report.c | 5 +++-- raster/r.geomorphon/main.c | 4 ++-- raster/r.in.mat/main.c | 8 +++---- raster/r.in.xyz/main.c | 32 ++++++++++++++-------------- raster/r.param.scale/process.c | 4 ++-- raster/r.regression.multi/main.c | 4 ++-- raster/r.resamp.filter/main.c | 4 ++-- raster/r.resamp.stats/main.c | 4 ++-- raster/r.ros/main.c | 4 ++-- raster/r.ros/spot_dist.c | 2 +- raster/r.sunhours/solpos00.c | 2 +- raster/r.surf.fractal/process.c | 6 +++--- raster/r.surf.fractal/spec_syn.c | 4 ++-- raster/r.texture/h_measure.c | 4 ++-- raster/r.viewshed/eventlist.cpp | 3 ++- raster/r.viewshed/viewshed.cpp | 4 ++-- raster/r.watershed/ram/flag_create.c | 2 +- raster/r.watershed/ram/ramseg.c | 2 +- 19 files changed, 51 insertions(+), 49 deletions(-) diff --git a/raster/r.basins.fill/read_map.c b/raster/r.basins.fill/read_map.c index 7b0dbb3e4de..bb28edec106 100644 --- a/raster/r.basins.fill/read_map.c +++ b/raster/r.basins.fill/read_map.c @@ -28,7 +28,7 @@ CELL *read_map(const char *name, int nomask, int nrows, int ncols) void (*get_row)(int, CELL *, int); /* allocate entire map */ - map = (CELL *)G_malloc(nrows * ncols * sizeof(CELL)); + map = (CELL *)G_malloc((size_t)nrows * ncols * sizeof(CELL)); /* open the map */ fd = Rast_open_old(name, ""); diff --git a/raster/r.distance/report.c b/raster/r.distance/report.c index cdd38569046..d998595f3b1 100644 --- a/raster/r.distance/report.c +++ b/raster/r.distance/report.c @@ -79,8 +79,9 @@ void report(struct Parms *parms) } if (parms->sort > 0) - lines = (struct ReportLine *)G_malloc( - map1->edges.ncats * map2->edges.ncats * sizeof(struct ReportLine)); + lines = (struct ReportLine *)G_malloc((size_t)map1->edges.ncats * + map2->edges.ncats * + sizeof(struct ReportLine)); else lines = NULL; nlines = 0; diff --git a/raster/r.geomorphon/main.c b/raster/r.geomorphon/main.c index 70cacf77fc1..1d804a73306 100644 --- a/raster/r.geomorphon/main.c +++ b/raster/r.geomorphon/main.c @@ -326,8 +326,8 @@ int main(int argc, char **argv) * restore the region afterwards. */ if (oneoff) { - unsigned long window_square = nrows * ncols; - unsigned long search_square = 4 * search_cells * search_cells; + unsigned long window_square = (unsigned long)nrows * ncols; + unsigned long search_square = 4UL * search_cells * search_cells; if (window_square > WINDOW_THRESHOLD && window_square / search_square > 10) diff --git a/raster/r.in.mat/main.c b/raster/r.in.mat/main.c index 206e6e6f870..76e686cc85e 100644 --- a/raster/r.in.mat/main.c +++ b/raster/r.in.mat/main.c @@ -340,16 +340,16 @@ int main(int argc, char *argv[]) /* 0=double 1=float 2=32bit signed int 5=8bit * unsigned int(text) */ case 0: - G_fseek(fp1, mrows * ncols * sizeof(double), SEEK_CUR); + G_fseek(fp1, (off_t)mrows * ncols * sizeof(double), SEEK_CUR); break; case 1: - G_fseek(fp1, mrows * ncols * sizeof(float), SEEK_CUR); + G_fseek(fp1, (off_t)mrows * ncols * sizeof(float), SEEK_CUR); break; case 2: - G_fseek(fp1, mrows * ncols * sizeof(int), SEEK_CUR); + G_fseek(fp1, (off_t)mrows * ncols * sizeof(int), SEEK_CUR); break; case 5: - G_fseek(fp1, mrows * ncols * sizeof(char), SEEK_CUR); + G_fseek(fp1, (off_t)mrows * ncols * sizeof(char), SEEK_CUR); break; default: G_fatal_error("unusual array"); diff --git a/raster/r.in.xyz/main.c b/raster/r.in.xyz/main.c index 615f1d01a84..6b5c899fdad 100644 --- a/raster/r.in.xyz/main.c +++ b/raster/r.in.xyz/main.c @@ -858,31 +858,31 @@ int main(int argc, char *argv[]) switch (method) { case METHOD_N: /* n is a straight copy */ - Rast_raster_cpy(raster_row, - n_array + - (row * cols * Rast_cell_size(CELL_TYPE)), - cols, CELL_TYPE); + Rast_raster_cpy( + raster_row, + n_array + ((size_t)row * cols * Rast_cell_size(CELL_TYPE)), + cols, CELL_TYPE); break; case METHOD_MIN: - Rast_raster_cpy(raster_row, - min_array + - (row * cols * Rast_cell_size(rtype)), - cols, rtype); + Rast_raster_cpy( + raster_row, + min_array + ((size_t)row * cols * Rast_cell_size(rtype)), + cols, rtype); break; case METHOD_MAX: - Rast_raster_cpy(raster_row, - max_array + - (row * cols * Rast_cell_size(rtype)), - cols, rtype); + Rast_raster_cpy( + raster_row, + max_array + ((size_t)row * cols * Rast_cell_size(rtype)), + cols, rtype); break; case METHOD_SUM: - Rast_raster_cpy(raster_row, - sum_array + - (row * cols * Rast_cell_size(rtype)), - cols, rtype); + Rast_raster_cpy( + raster_row, + sum_array + ((size_t)row * cols * Rast_cell_size(rtype)), + cols, rtype); break; case METHOD_RANGE: /* (max-min) */ diff --git a/raster/r.param.scale/process.c b/raster/r.param.scale/process.c index 6a0da1dbd87..42a08945e41 100644 --- a/raster/r.param.scale/process.c +++ b/raster/r.param.scale/process.c @@ -96,10 +96,10 @@ void process(void) Rast_set_c_null_value(featrow_out, ncols); } - window_ptr = (DCELL *)G_malloc(SQR(wsize) * sizeof(DCELL)); + window_ptr = (DCELL *)G_malloc((size_t)SQR(wsize) * sizeof(DCELL)); /* Reserve enough memory for local wind. */ - weight_ptr = (double *)G_malloc(SQR(wsize) * sizeof(double)); + weight_ptr = (double *)G_malloc((size_t)SQR(wsize) * sizeof(double)); /* Reserve enough memory weights matrix. */ normal_ptr = dmatrix(0, 5, 0, 5); /* Allocate memory for 6*6 matrix */ diff --git a/raster/r.regression.multi/main.c b/raster/r.regression.multi/main.c index da9bb0ae704..2cb686cb306 100644 --- a/raster/r.regression.multi/main.c +++ b/raster/r.regression.multi/main.c @@ -249,7 +249,7 @@ int main(int argc, char *argv[]) m = &(m_all[0]); m->n = n_predictors + 1; - m->v = (double *)G_malloc(m->n * m->n * sizeof(double)); + m->v = (double *)G_malloc((size_t)m->n * m->n * sizeof(double)); a[0] = (double *)G_malloc(m->n * sizeof(double)); B[0] = (double *)G_malloc(m->n * sizeof(double)); @@ -264,7 +264,7 @@ int main(int argc, char *argv[]) for (k = 1; k <= n_predictors; k++) { m = &(m_all[k]); m->n = n_predictors; - m->v = (double *)G_malloc(m->n * m->n * sizeof(double)); + m->v = (double *)G_malloc((size_t)m->n * m->n * sizeof(double)); a[k] = (double *)G_malloc(m->n * sizeof(double)); B[k] = (double *)G_malloc(m->n * sizeof(double)); diff --git a/raster/r.resamp.filter/main.c b/raster/r.resamp.filter/main.c index 2d1d3e84d4e..73557fd03b9 100644 --- a/raster/r.resamp.filter/main.c +++ b/raster/r.resamp.filter/main.c @@ -170,7 +170,7 @@ static void make_h_weights(void) { int col; - h_weights = G_malloc(dst_w.cols * col_scale * sizeof(double)); + h_weights = G_malloc((size_t)dst_w.cols * col_scale * sizeof(double)); mapcol0 = G_malloc(dst_w.cols * sizeof(int)); mapcol1 = G_malloc(dst_w.cols * sizeof(int)); @@ -213,7 +213,7 @@ static void make_v_weights(void) { int row; - v_weights = G_malloc(dst_w.rows * row_scale * sizeof(double)); + v_weights = G_malloc((size_t)dst_w.rows * row_scale * sizeof(double)); maprow0 = G_malloc(dst_w.rows * sizeof(int)); maprow1 = G_malloc(dst_w.rows * sizeof(int)); diff --git a/raster/r.resamp.stats/main.c b/raster/r.resamp.stats/main.c index 411694ecb88..7ac4795d24e 100644 --- a/raster/r.resamp.stats/main.c +++ b/raster/r.resamp.stats/main.c @@ -92,7 +92,7 @@ static void resamp_unweighted(void) method_fn = menu[method].method; - values = G_malloc(row_scale * col_scale * sizeof(DCELL)); + values = G_malloc((size_t)row_scale * col_scale * sizeof(DCELL)); col_map = G_malloc((dst_w.cols + 1) * sizeof(int)); row_map = G_malloc((dst_w.rows + 1) * sizeof(int)); @@ -164,7 +164,7 @@ static void resamp_weighted(void) method_fn = menu[method].method_w; - values = G_malloc(row_scale * col_scale * 2 * sizeof(DCELL)); + values = G_malloc((size_t)row_scale * col_scale * 2 * sizeof(DCELL)); col_map = G_malloc((dst_w.cols + 1) * sizeof(double)); row_map = G_malloc((dst_w.rows + 1) * sizeof(double)); diff --git a/raster/r.ros/main.c b/raster/r.ros/main.c index 63c3dad29c5..b6801d9c27a 100644 --- a/raster/r.ros/main.c +++ b/raster/r.ros/main.c @@ -715,8 +715,8 @@ int main(int argc, char *argv[]) A = 133 / pow(sigma[fuel[col]], 0.7913); gammamax = pow(sigma[fuel[col]], 1.5) / (495 + 0.0594 * pow(sigma[fuel[col]], 1.5)); - gamma = - gammamax * pow(beta / betaop, A) * exp(A * (1 - beta / betaop)); + gamma = gammamax * pow(beta / betaop, A) * + exp((double)A * (1 - beta / betaop)); xi = exp((0.792 + 0.681 * pow(sigma[fuel[col]], 0.5)) * (beta + 0.1)) / (192 + 0.2595 * sigma[fuel[col]]); diff --git a/raster/r.ros/spot_dist.c b/raster/r.ros/spot_dist.c index c8fbedcd02e..1c7ee64877d 100644 --- a/raster/r.ros/spot_dist.c +++ b/raster/r.ros/spot_dist.c @@ -99,7 +99,7 @@ int spot_dist(int fuel, float maxros, int speed, float angle, int row0, /* get I from Byram's equation, I = R*w*h, cited in Rothermel (1991) */ R = maxros / 60.0; - I = R * w[fuel] * 8000; + I = (double)R * w[fuel] * 8000; /* get h0 (originally z0) and z0 (e0 + h0) from Chase (1984) */ U = 2 * speed / 88.0; diff --git a/raster/r.sunhours/solpos00.c b/raster/r.sunhours/solpos00.c index 3f3eff79d41..518da40b367 100644 --- a/raster/r.sunhours/solpos00.c +++ b/raster/r.sunhours/solpos00.c @@ -701,7 +701,7 @@ static void sbcf(struct posdata *pdat, struct trigdata *tdat) localtrig(pdat, tdat); p = 0.6366198 * pdat->sbwid / pdat->sbrad * pow(tdat->cd, 3); t1 = tdat->sl * tdat->sd * pdat->ssha * DEG2RAD; - t2 = tdat->cl * tdat->cd * sin(pdat->ssha * DEG2RAD); + t2 = (double)tdat->cl * tdat->cd * sin(pdat->ssha * DEG2RAD); pdat->sbcf = pdat->sbsky + 1.0 / (1.0 - p * (t1 + t2)); } diff --git a/raster/r.surf.fractal/process.c b/raster/r.surf.fractal/process.c index 9bce8a11d62..563ebe13970 100644 --- a/raster/r.surf.fractal/process.c +++ b/raster/r.surf.fractal/process.c @@ -48,12 +48,12 @@ int process(void) /*------------------------------------------------------------------*/ - if (nn * nn * sizeof(double) < 1) + if ((size_t)nn * nn * sizeof(double) < 1) G_fatal_error(_("Unable to allocate data buffer. " "Check current region with g.region.")); - data[0] = (double *)G_malloc(nn * nn * sizeof(double)); - data[1] = (double *)G_malloc(nn * nn * sizeof(double)); + data[0] = (double *)G_malloc((size_t)nn * nn * sizeof(double)); + data[1] = (double *)G_malloc((size_t)nn * nn * sizeof(double)); /*------------------------------------------------------------------*/ /* Apply spectral synthesis algorithm. */ diff --git a/raster/r.surf.fractal/spec_syn.c b/raster/r.surf.fractal/spec_syn.c index 23acb75024f..0f9beaf21b8 100644 --- a/raster/r.surf.fractal/spec_syn.c +++ b/raster/r.surf.fractal/spec_syn.c @@ -42,8 +42,8 @@ int specsyn(double *data[2], /* Array holding complex data to transform. */ double phase, rad, /* polar coordinates of Fourier coeff. */ *temp[2]; - temp[0] = (double *)G_malloc(nn * nn * sizeof(double)); - temp[1] = (double *)G_malloc(nn * nn * sizeof(double)); + temp[0] = (double *)G_malloc((size_t)nn * nn * sizeof(double)); + temp[1] = (double *)G_malloc((size_t)nn * nn * sizeof(double)); /* ---------------------------------------------------------------- */ /* --- Create fractal surface --- */ diff --git a/raster/r.texture/h_measure.c b/raster/r.texture/h_measure.c index d81104b27b3..9665c082a54 100644 --- a/raster/r.texture/h_measure.c +++ b/raster/r.texture/h_measure.c @@ -407,7 +407,7 @@ float f12_icorr(struct matvec *mv) for (i = 0; i < Ng; i++) { for (j = 0; j < Ng; j++) { if (px[i] * py[j] > 0) - hxy1 -= P[i][j] * log2(px[i] * py[j]); + hxy1 -= P[i][j] * log2((double)px[i] * py[j]); if (P[i][j] > 0) hxy -= P[i][j] * log2(P[i][j]); } @@ -439,7 +439,7 @@ float f13_icorr(struct matvec *mv) for (i = 0; i < Ng; i++) { for (j = 0; j < Ng; j++) { if (px[i] * py[j] > 0) - hxy2 -= px[i] * py[j] * log2(px[i] * py[j]); + hxy2 -= (double)px[i] * py[j] * log2((double)px[i] * py[j]); if (P[i][j] > 0) hxy -= P[i][j] * log2(P[i][j]); } diff --git a/raster/r.viewshed/eventlist.cpp b/raster/r.viewshed/eventlist.cpp index 50f2ec6cb4a..dd3e648597c 100644 --- a/raster/r.viewshed/eventlist.cpp +++ b/raster/r.viewshed/eventlist.cpp @@ -64,7 +64,8 @@ double calculate_center_gradient(AEvent *e, Viewpoint *vp) sqdist = (e->row - vp->row) * (e->row - vp->row) + (e->col - vp->col) * (e->col - vp->col); - gradient = (e->elev[1] - vp->elev) * (e->elev[1] - vp->elev) / sqdist; + gradient = + (double)(e->elev[1] - vp->elev) * (e->elev[1] - vp->elev) / sqdist; /*maintain sign */ if (e->elev[1] < vp->elev) gradient = -gradient; diff --git a/raster/r.viewshed/viewshed.cpp b/raster/r.viewshed/viewshed.cpp index 567ddbbf0eb..edd15223b42 100644 --- a/raster/r.viewshed/viewshed.cpp +++ b/raster/r.viewshed/viewshed.cpp @@ -123,7 +123,7 @@ AEvent *allocate_eventlist(GridHeader *hd) AEvent *eventList; - long long totalsize = hd->ncols * hd->nrows * 3; + long long totalsize = (long long)hd->ncols * hd->nrows * 3; totalsize *= sizeof(AEvent); G_debug(1, "total size of eventlist is %lld B (%d MB); ", totalsize, @@ -197,7 +197,7 @@ MemoryVisibilityGrid *viewshed_in_memory(char *inputfname, GridHeader *hd, assert(visgrid); G_debug(1, "visibility grid size: %d x %d x %d B (%d MB)", hd->nrows, hd->ncols, (int)sizeof(float), - (int)(((long long)(hd->nrows * hd->ncols * sizeof(float))) >> 20)); + (int)(((long long)hd->nrows * hd->ncols * sizeof(float)) >> 20)); /* ------------------------------ */ /* construct the event list corresponding to the given input file diff --git a/raster/r.watershed/ram/flag_create.c b/raster/r.watershed/ram/flag_create.c index 20acb4fc2fe..85f2f19b4f5 100644 --- a/raster/r.watershed/ram/flag_create.c +++ b/raster/r.watershed/ram/flag_create.c @@ -14,7 +14,7 @@ FLAG *flag_create(int nrows, int ncols) new_flag->array = (unsigned char **)G_malloc(nrows * sizeof(unsigned char *)); - temp = (unsigned char *)G_malloc(nrows * new_flag->leng * + temp = (unsigned char *)G_malloc((size_t)nrows * new_flag->leng * sizeof(unsigned char)); for (i = 0; i < nrows; i++) { diff --git a/raster/r.watershed/ram/ramseg.c b/raster/r.watershed/ram/ramseg.c index 7e9393fc5f4..157cebc90db 100644 --- a/raster/r.watershed/ram/ramseg.c +++ b/raster/r.watershed/ram/ramseg.c @@ -23,7 +23,7 @@ size_t seg_index_rc(int ramseg, size_t seg_index, int *r, int *c) seg_no = seg_index >> DOUBLEBITS; seg_remainder = seg_index - (seg_no << DOUBLEBITS); *r = ((seg_no / ramseg) << RAMSEGBITS) + (seg_remainder >> RAMSEGBITS); - *c = ((seg_no - ((*r) >> RAMSEGBITS) * ramseg) << RAMSEGBITS) + + *c = ((seg_no - (size_t)((*r) >> RAMSEGBITS) * ramseg) << RAMSEGBITS) + seg_remainder - (((*r) & SEGLENLESS) << RAMSEGBITS); return seg_no; } From 39aa16dd217a83c661559654ac13ca1a1d19ad2a Mon Sep 17 00:00:00 2001 From: cwhite911 Date: Fri, 17 Jul 2026 16:53:21 -0400 Subject: [PATCH 2/2] r.param.scale: Compute window size with integer math CodeQL flagged process.c:99,102: SQR() uses the float sqrarg, so SQR(wsize) does a float multiplication that the macro's ternary then widens to double, and the (size_t) cast applied afterwards does not prevent the float overflow. wsize is an int window size, so compute the window area as (size_t)wsize * wsize instead, keeping the whole allocation size in integer/size_t math. Fixes the 2 CodeQL cpp/integer-multiplication-cast-to-long alerts this PR previously reintroduced. --- raster/r.param.scale/process.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/raster/r.param.scale/process.c b/raster/r.param.scale/process.c index 42a08945e41..2fdb31147af 100644 --- a/raster/r.param.scale/process.c +++ b/raster/r.param.scale/process.c @@ -96,10 +96,10 @@ void process(void) Rast_set_c_null_value(featrow_out, ncols); } - window_ptr = (DCELL *)G_malloc((size_t)SQR(wsize) * sizeof(DCELL)); + window_ptr = (DCELL *)G_malloc((size_t)wsize * wsize * sizeof(DCELL)); /* Reserve enough memory for local wind. */ - weight_ptr = (double *)G_malloc((size_t)SQR(wsize) * sizeof(double)); + weight_ptr = (double *)G_malloc((size_t)wsize * wsize * sizeof(double)); /* Reserve enough memory weights matrix. */ normal_ptr = dmatrix(0, 5, 0, 5); /* Allocate memory for 6*6 matrix */