Skip to content

Potential fix for code scanning alert no. 28: Multiplication result converted to larger type - #732

Merged
mrjimenez merged 1 commit into
masterfrom
alert-autofix-28
May 27, 2026
Merged

Potential fix for code scanning alert no. 28: Multiplication result converted to larger type#732
mrjimenez merged 1 commit into
masterfrom
alert-autofix-28

Conversation

@mrjimenez

Copy link
Copy Markdown
Contributor

Potential fix for https://github.com/amule-project/amule/security/code-scanning/28

To fix this without changing behavior, force the multiplication on line 199 to be evaluated in 64-bit arithmetic before addition.
Best approach: cast one operand to uint64_t (or another known wide unsigned type used for tick math) so the product cannot overflow 32-bit first.

In src/kademlia/net/PacketTracking.cpp, update the expression:

  • From: it->m_firstAdded += SEC2MS(secondsPerPacket) * removeCount;
  • To: it->m_firstAdded += static_cast<uint64_t>(SEC2MS(secondsPerPacket)) * removeCount;

This preserves existing logic and only changes arithmetic width of the intermediate product. No new methods or dependencies are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…onverted to larger type

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@mrjimenez
mrjimenez marked this pull request as ready for review May 27, 2026 00:02
@mrjimenez
mrjimenez merged commit fbaf4e7 into master May 27, 2026
14 checks passed
@mrjimenez
mrjimenez deleted the alert-autofix-28 branch May 27, 2026 14:25
mrjimenez pushed a commit to mrjimenez/amule that referenced this pull request Aug 1, 2026
…amule-project#732)

connButImg() carried ~300 lines of raw XPM/pixel data for the 3 states
of the per-tab Connect/Cancel/Disconnect button (ServerWnd, KadDlg),
manually rescaled and cached in ScaledConnButImg(). The SVG assets for
all 3 states (toolbar_connect/_disconnect/_connecting) already existed
in src/icons/ and were already compiled into icon_data.c, but nothing
referenced them.

Mapping verified against SetConnectButtonState's existing switch (the
button shows the icon for the action it performs): default/off state
("Connect" label) -> toolbar_connect, connected ("Disconnect" label)
-> toolbar_disconnect, connecting ("Cancel" label) -> toolbar_connecting.

SetConnectButtonState now looks the art up via wxArtProvider::
GetBitmapBundle(), same pattern already used for the status-bar and
main-toolbar icons (amuleDlg.cpp). This also drops the manual
rescale-cache: CreateBitmapBundle() rasterizes the SVG straight at the
requested 16x16 logical size on demand, so there's no more raster ->
ConvertToImage -> Rescale round-trip to cache against.

Verified via a full `amule` build (macOS) after the change, and a
clang-format v18 (Docker, pinned per project convention) pass -- diff
is otherwise clean, only the intended lines touched.
mrjimenez pushed a commit to mrjimenez/amule that referenced this pull request Aug 1, 2026
…or tab-close (amule-project#675) (amule-project#735)

* feat(gui): migrate Friends/Messages headers, reload buttons, folder tree, and tab-close icons to CamuleArtProvider

Continues the icon-system cleanup scoped in amule-project#675, independent of
amule-project#732/amule-project#733 (different files, no overlap).

- amuleDlgImages(14)/(15): the small header icons in the Friends and
  Messages tabs. Friends gets a new "amule:friends" SVG; Messages
  reuses the existing "amule:toolbar_messages" art, requested at an
  explicit 16x16 so it doesn't inherit the toolbar's 32x32 natural
  size.
- amuleDlgImages(18)/(30): the "reload list" buttons (shared files,
  ED2K server list, Kad node list) -- three call sites, one new
  "amule:reload" SVG (see below for its own history).
- amuleSpecial(1)/(2): the shared-directory tree's folder icons get
  new "amule:folder"/"amule:folder_shared" SVGs -- same shape, tinted
  orange vs. red, matching how the original raw bitmaps only differed
  by colour.
- amuleSpecial(3)/(4): the chat/search notebook tabs' close-on-hover
  icon, replaced with wx's own stock wxART_CLOSE for both states
  instead of a second bespoke asset (both were the same "X in a box"
  bitmap, differing only by a hover-highlight border colour).

reload.svg's own history, per PR review: the first hand-drawn attempt
(thin blue single arc) didn't match the original at all -- got3nks
caught it, I reconstructed the original amuleDlgImages(18) raster to
check (a thicker green double-arrow circle) and redrew closer to that,
which still wasn't good enough. Final version is AI-vectorized via
Recraft (through the Higgsfield MCP), which got3nks preferred over
further hand-drawn iterations.

src/icons/icon_data.c (the checked-in fallback used when Python3 is
absent at configure time, per amule-project#487) regenerated via embed_icons.py to
match.

Rebased onto current master (picking up amule-project#732/amule-project#733/amule-project#739, which all
touch the same amuleSpecial/amuleDlgImages functions) -- conflicts
resolved by redoing the index deletions against the current tree
rather than replaying the stale patch, since amule-project#725/amule-project#733 already moved
the surrounding line numbers.

Verified via a full amule build (macOS) and a visual check of every
call site: Friends/Messages tab headers, the ED2K server-list and Kad
node-list reload buttons, the shared-files reload button, and the
Preferences > Directory shared-folder tree.

* fix(gui): thicker reload stroke, dedicated message-bubble icon (amule-project#735 review)

got3nks, testing amule-project#735:
- reload: arrow bodies read too thin at 16px. Regenerated via Recraft
  with an explicit thicker/bolder-stroke prompt.
- Messages panel header: reusing "amule:toolbar_messages" (the main
  toolbar's detailed gradient mascot bust) at 16x16 doesn't read as
  "messages" once shrunk that far from its 32x32 native size. Added a
  dedicated "amule:message" chat-bubble glyph instead, sized for
  legibility at 16x16 specifically, and pointed the Messages panel
  header at it instead of the toolbar art.

Folder/folder_shared and the tab-close X were already approved as-is.

Verified via a full amule build (macOS) and a visual check of both
fixes: the shared-files reload button and the Messages panel header.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant