Potential fix for code scanning alert no. 28: Multiplication result converted to larger type - #732
Merged
Merged
Conversation
…onverted to larger type Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
mrjimenez
marked this pull request as ready for review
May 27, 2026 00:02
mrjimenez
pushed a commit
to mrjimenez/amule
that referenced
this pull request
Aug 1, 2026
…amule-project#732) connButImg() carried ~300 lines of raw XPM/pixel data for the 3 states of the per-tab Connect/Cancel/Disconnect button (ServerWnd, KadDlg), manually rescaled and cached in ScaledConnButImg(). The SVG assets for all 3 states (toolbar_connect/_disconnect/_connecting) already existed in src/icons/ and were already compiled into icon_data.c, but nothing referenced them. Mapping verified against SetConnectButtonState's existing switch (the button shows the icon for the action it performs): default/off state ("Connect" label) -> toolbar_connect, connected ("Disconnect" label) -> toolbar_disconnect, connecting ("Cancel" label) -> toolbar_connecting. SetConnectButtonState now looks the art up via wxArtProvider:: GetBitmapBundle(), same pattern already used for the status-bar and main-toolbar icons (amuleDlg.cpp). This also drops the manual rescale-cache: CreateBitmapBundle() rasterizes the SVG straight at the requested 16x16 logical size on demand, so there's no more raster -> ConvertToImage -> Rescale round-trip to cache against. Verified via a full `amule` build (macOS) after the change, and a clang-format v18 (Docker, pinned per project convention) pass -- diff is otherwise clean, only the intended lines touched.
mrjimenez
pushed a commit
to mrjimenez/amule
that referenced
this pull request
Aug 1, 2026
…or tab-close (amule-project#675) (amule-project#735) * feat(gui): migrate Friends/Messages headers, reload buttons, folder tree, and tab-close icons to CamuleArtProvider Continues the icon-system cleanup scoped in amule-project#675, independent of amule-project#732/amule-project#733 (different files, no overlap). - amuleDlgImages(14)/(15): the small header icons in the Friends and Messages tabs. Friends gets a new "amule:friends" SVG; Messages reuses the existing "amule:toolbar_messages" art, requested at an explicit 16x16 so it doesn't inherit the toolbar's 32x32 natural size. - amuleDlgImages(18)/(30): the "reload list" buttons (shared files, ED2K server list, Kad node list) -- three call sites, one new "amule:reload" SVG (see below for its own history). - amuleSpecial(1)/(2): the shared-directory tree's folder icons get new "amule:folder"/"amule:folder_shared" SVGs -- same shape, tinted orange vs. red, matching how the original raw bitmaps only differed by colour. - amuleSpecial(3)/(4): the chat/search notebook tabs' close-on-hover icon, replaced with wx's own stock wxART_CLOSE for both states instead of a second bespoke asset (both were the same "X in a box" bitmap, differing only by a hover-highlight border colour). reload.svg's own history, per PR review: the first hand-drawn attempt (thin blue single arc) didn't match the original at all -- got3nks caught it, I reconstructed the original amuleDlgImages(18) raster to check (a thicker green double-arrow circle) and redrew closer to that, which still wasn't good enough. Final version is AI-vectorized via Recraft (through the Higgsfield MCP), which got3nks preferred over further hand-drawn iterations. src/icons/icon_data.c (the checked-in fallback used when Python3 is absent at configure time, per amule-project#487) regenerated via embed_icons.py to match. Rebased onto current master (picking up amule-project#732/amule-project#733/amule-project#739, which all touch the same amuleSpecial/amuleDlgImages functions) -- conflicts resolved by redoing the index deletions against the current tree rather than replaying the stale patch, since amule-project#725/amule-project#733 already moved the surrounding line numbers. Verified via a full amule build (macOS) and a visual check of every call site: Friends/Messages tab headers, the ED2K server-list and Kad node-list reload buttons, the shared-files reload button, and the Preferences > Directory shared-folder tree. * fix(gui): thicker reload stroke, dedicated message-bubble icon (amule-project#735 review) got3nks, testing amule-project#735: - reload: arrow bodies read too thin at 16px. Regenerated via Recraft with an explicit thicker/bolder-stroke prompt. - Messages panel header: reusing "amule:toolbar_messages" (the main toolbar's detailed gradient mascot bust) at 16x16 doesn't read as "messages" once shrunk that far from its 32x32 native size. Added a dedicated "amule:message" chat-bubble glyph instead, sized for legibility at 16x16 specifically, and pointed the Messages panel header at it instead of the toolbar art. Folder/folder_shared and the tab-close X were already approved as-is. Verified via a full amule build (macOS) and a visual check of both fixes: the shared-files reload button and the Messages panel header.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/amule-project/amule/security/code-scanning/28
To fix this without changing behavior, force the multiplication on line 199 to be evaluated in 64-bit arithmetic before addition.
Best approach: cast one operand to
uint64_t(or another known wide unsigned type used for tick math) so the product cannot overflow 32-bit first.In
src/kademlia/net/PacketTracking.cpp, update the expression:it->m_firstAdded += SEC2MS(secondsPerPacket) * removeCount;it->m_firstAdded += static_cast<uint64_t>(SEC2MS(secondsPerPacket)) * removeCount;This preserves existing logic and only changes arithmetic width of the intermediate product. No new methods or dependencies are needed.
Suggested fixes powered by Copilot Autofix. Review carefully before merging.