Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c49f75b

Browse files
committed
MNT: ensure pre-multiplication casting to prevent overflow
1 parent c6cf3fa commit c49f75b

File tree

4 files changed

+11
-7
lines changed

4 files changed

+11
-7
lines changed

src/_backend_agg.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ void BufferRegion::to_string_argb(uint8_t *buf)
1111
unsigned char tmp;
1212
size_t i, j;
1313

14-
memcpy(buf, data, height * stride);
14+
memcpy(buf, data, (size_t) height * stride);
1515

1616
for (i = 0; i < (size_t)height; ++i) {
1717
pix = buf + i * stride;

src/_backend_agg.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1124,7 +1124,7 @@ class QuadMeshGenerator
11241124

11251125
inline size_t num_paths() const
11261126
{
1127-
return m_meshWidth * m_meshHeight;
1127+
return (size_t) m_meshWidth * m_meshHeight;
11281128
}
11291129

11301130
inline path_iterator operator()(size_t i) const

src/_backend_agg_wrapper.cpp

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,10 @@ static void PyBufferRegion_dealloc(PyBufferRegion *self)
4646

4747
static PyObject *PyBufferRegion_to_string(PyBufferRegion *self, PyObject *args)
4848
{
49-
return PyBytes_FromStringAndSize((const char *)self->x->get_data(),
50-
self->x->get_height() * self->x->get_stride());
49+
Py_ssize_t height, stride;
50+
height = self->x->get_height();
51+
stride = self->x->get_stride();
52+
return PyBytes_FromStringAndSize((const char *)self->x->get_data(), height * stride);
5153
}
5254

5355
/* TODO: This doesn't seem to be used internally. Remove? */
@@ -85,8 +87,10 @@ static PyObject *PyBufferRegion_to_string_argb(PyBufferRegion *self, PyObject *a
8587
{
8688
PyObject *bufobj;
8789
uint8_t *buf;
88-
89-
bufobj = PyBytes_FromStringAndSize(NULL, self->x->get_height() * self->x->get_stride());
90+
Py_ssize_t height, stride;
91+
height = self->x->get_height();
92+
stride = self->x->get_stride();
93+
bufobj = PyBytes_FromStringAndSize(NULL, height * stride);
9094
buf = (uint8_t *)PyBytes_AS_STRING(bufobj);
9195

9296
CALL_CPP_CLEANUP("to_string_argb", (self->x->to_string_argb(buf)), Py_DECREF(bufobj));

src/_path.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1222,7 +1222,7 @@ bool convert_to_string(PathIterator &path,
12221222
clipped_t clipped(nan_removed, do_clip, clip_rect);
12231223
simplify_t simplified(clipped, simplify, path.simplify_threshold());
12241224

1225-
buffersize = path.total_vertices() * (precision + 5) * 4;
1225+
buffersize = (size_t) path.total_vertices() * (precision + 5) * 4;
12261226
if (buffersize == 0) {
12271227
return true;
12281228
}

0 commit comments

Comments
 (0)