MNT: ensure pre-multiplication casting to prevent overflow

tacaswell · tacaswell · commit c49f75ba0a25 · 2022-09-06T20:00:57.000-04:00
diff --git a/src/_backend_agg.cpp b/src/_backend_agg.cpp
@@ -11,7 +11,7 @@ void BufferRegion::to_string_argb(uint8_t *buf)
     unsigned char tmp;
     size_t i, j;
 
-    memcpy(buf, data, height * stride);
+    memcpy(buf, data, (size_t) height * stride);
 
     for (i = 0; i < (size_t)height; ++i) {
         pix = buf + i * stride;
diff --git a/src/_backend_agg.h b/src/_backend_agg.h
@@ -1124,7 +1124,7 @@ class QuadMeshGenerator
 
     inline size_t num_paths() const
     {
-        return m_meshWidth * m_meshHeight;
+        return (size_t) m_meshWidth * m_meshHeight;
     }
 
     inline path_iterator operator()(size_t i) const
diff --git a/src/_backend_agg_wrapper.cpp b/src/_backend_agg_wrapper.cpp
@@ -46,8 +46,10 @@ static void PyBufferRegion_dealloc(PyBufferRegion *self)
 
 static PyObject *PyBufferRegion_to_string(PyBufferRegion *self, PyObject *args)
 {
-    return PyBytes_FromStringAndSize((const char *)self->x->get_data(),
-                                     self->x->get_height() * self->x->get_stride());
+    Py_ssize_t height, stride;
+    height = self->x->get_height();
+    stride = self->x->get_stride();
+    return PyBytes_FromStringAndSize((const char *)self->x->get_data(), height * stride);
 }
 
 /* TODO: This doesn't seem to be used internally.  Remove? */
@@ -85,8 +87,10 @@ static PyObject *PyBufferRegion_to_string_argb(PyBufferRegion *self, PyObject *a
 {
     PyObject *bufobj;
     uint8_t *buf;
-
-    bufobj = PyBytes_FromStringAndSize(NULL, self->x->get_height() * self->x->get_stride());
+    Py_ssize_t height, stride;
+    height = self->x->get_height();
+    stride = self->x->get_stride();
+    bufobj = PyBytes_FromStringAndSize(NULL, height * stride);
     buf = (uint8_t *)PyBytes_AS_STRING(bufobj);
 
     CALL_CPP_CLEANUP("to_string_argb", (self->x->to_string_argb(buf)), Py_DECREF(bufobj));
diff --git a/src/_path.h b/src/_path.h
@@ -1222,7 +1222,7 @@ bool convert_to_string(PathIterator &path,
     clipped_t clipped(nan_removed, do_clip, clip_rect);
     simplify_t simplified(clipped, simplify, path.simplify_threshold());
 
-    buffersize = path.total_vertices() * (precision + 5) * 4;
+    buffersize = (size_t) path.total_vertices() * (precision + 5) * 4;
     if (buffersize == 0) {
         return true;
     }

Original file line number	Diff line number	Diff line change
`@@ -1124,7 +1124,7 @@ class QuadMeshGenerator`
`1124`	`1124`
`1125`	`1125`	`inline size_t num_paths() const`
`1126`	`1126`	`{`
`1127`		`- return m_meshWidth * m_meshHeight;`
	`1127`	`+ return (size_t) m_meshWidth * m_meshHeight;`
`1128`	`1128`	`}`
`1129`	`1129`
`1130`	`1130`	`inline path_iterator operator()(size_t i) const`
Original file line number	Diff line number	Diff line change
`@@ -1222,7 +1222,7 @@ bool convert_to_string(PathIterator &path,`
`1222`	`1222`	`clipped_t clipped(nan_removed, do_clip, clip_rect);`
`1223`	`1223`	`simplify_t simplified(clipped, simplify, path.simplify_threshold());`
`1224`	`1224`
`1225`		`- buffersize = path.total_vertices() * (precision + 5) * 4;`
	`1225`	`+ buffersize = (size_t) path.total_vertices() * (precision + 5) * 4;`
`1226`	`1226`	`if (buffersize == 0) {`
`1227`	`1227`	`return true;`
`1228`	`1228`	`}`