Repository navigation
tools: Fix multiplications converted to a larger type - #7708
Merged
Merged
Conversation
Cast the first operand so that integer products used as allocation sizes, memset lengths, cell counts, and file offsets are computed in size_t, long, or off_t instead of int, and so that int or float products consumed as double (D_text_size, floor, region bounds) are computed in double. Fixes 24 CodeQL cpp/integer-multiplication-cast-to-long alerts across display, general, imagery, raster3d, vector, and visualization tools.
github-actions
Bot
added
vector
petrasovaa
requested changes
Aug 24, 2026
petrasovaa
left a comment
petrasovaa
left a comment
Contributor
There was a problem hiding this comment.
If you limit it to changes in d.graph/do_graph.c, d.legend/draw.c, r3.in.v5d, r3.out.v5d, i.segment/flag.c, v.vol.rst/user3.c, ximgview/color.c, I would approve it, the others have some issues that would require more thinking.
Contributor
Author
Done |
petrasovaa
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes 24 CodeQL
cpp/integer-multiplication-cast-to-longalerts across display, general, imagery, raster3d, vector, and visualization tools. Together with #7704, #7705, and #7706 this covers all alerts for this rule except the r.sunmask and d.linegraph clusters, which involve a larger float-precision type change and are handled separately.Same idiom as the sibling PRs (cast the first operand so the product is computed in the consuming type):
memsetlengths, cell counts, and offsets, which could overflowintfor very large inputs: g.pnmcomp, i.fft, i.ifft, i.rectify and i.ortho.rectify reports, i.segment, r3.out.v5d, v.surf.rst and v.vol.rst disk estimates and temp-file offsets, ximgview color table.intorfloatproducts consumed asdouble(D_text_size,floor, region bound arithmetic): d.graph, d.legend, r3.in.v5d, v.extract random selection.Verification: all 14 tools compile cleanly, and the four existing testsuites among them (i.fft, i.segment, v.extract, v.surf.rst) pass against nc_spm.
This is part of a larger effort to work through the open code scanning alerts, grouped into small PRs by issue type.
Written with the assistance of Claude Code.