Skip to content

Potential fix for code scanning alert no. 29: Multiplication result converted to larger type - #733

Merged
mrjimenez merged 1 commit into
masterfrom
alert-autofix-29
May 27, 2026
Merged

Potential fix for code scanning alert no. 29: Multiplication result converted to larger type#733
mrjimenez merged 1 commit into
masterfrom
alert-autofix-29

Conversation

@mrjimenez

Copy link
Copy Markdown
Contributor

Potential fix for https://github.com/amule-project/amule/security/code-scanning/29

The fix is to cast one multiplicand to a sufficiently wide integer type before multiplication so the intermediate result cannot overflow at 32 bits.

Best targeted fix (without changing behavior) in src/kademlia/net/PacketTracking.cpp:

  • Update line 205 expression from SEC2MS(secondsPerPacket) * it->m_count to static_cast<uint64_t>(SEC2MS(secondsPerPacket)) * it->m_count.
  • For consistency and to avoid the same risk in nearby arithmetic, apply the same widening on line 199 where the same product is added to m_firstAdded.

No new methods or dependencies are needed. uint64_t is already used in this file, so no import/include change is required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…onverted to larger type

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@mrjimenez
mrjimenez marked this pull request as ready for review May 27, 2026 00:06
@mrjimenez
mrjimenez merged commit 23113ff into master May 27, 2026
14 checks passed
@mrjimenez
mrjimenez deleted the alert-autofix-29 branch May 27, 2026 14:26
mrjimenez pushed a commit to mrjimenez/amule that referenced this pull request Aug 1, 2026
…ar icons (amule-project#733)

Add_Skin_Icon()'s stdIcon argument was only ever consulted when no skin
was active AND the CamuleArtProvider ("amule:toolbar_<name>") lookup
failed. Every built-in toolbar icon ships embedded in icon_data.c,
generated from the same src/icons/ sources CamuleArtProvider reads --
that lookup failing is a broken-build condition, not one reachable at
runtime with a correct build, so the 10 bespoke ~130-line raw-pixel
fallback bitmaps in amuleDlgImages() (indices 20-26, 29, 32, 33) were
dead weight kept alive only by that one impossible branch.

Apply_Toolbar_Skin() now passes wxNullBitmap for these 10 calls, and
Add_Skin_Icon() falls back to wxART_MISSING_IMAGE (a generic stock
icon, always available, no embedding needed) if the lookup somehow
still fails, instead of silently misaligning m_tblist by skipping the
push.

Verified via a full amule build (macOS) and a visual check that the
main toolbar (Networks/Search/Download/Shared/Messages/Stats/Prefs/
Import/About/Blink) renders all 10 icons correctly with no fallback
triggered.

Co-authored-by: got3nks <[email protected]>
mrjimenez pushed a commit to mrjimenez/amule that referenced this pull request Aug 1, 2026
…or tab-close (amule-project#675) (amule-project#735)

* feat(gui): migrate Friends/Messages headers, reload buttons, folder tree, and tab-close icons to CamuleArtProvider

Continues the icon-system cleanup scoped in amule-project#675, independent of
amule-project#732/amule-project#733 (different files, no overlap).

- amuleDlgImages(14)/(15): the small header icons in the Friends and
  Messages tabs. Friends gets a new "amule:friends" SVG; Messages
  reuses the existing "amule:toolbar_messages" art, requested at an
  explicit 16x16 so it doesn't inherit the toolbar's 32x32 natural
  size.
- amuleDlgImages(18)/(30): the "reload list" buttons (shared files,
  ED2K server list, Kad node list) -- three call sites, one new
  "amule:reload" SVG (see below for its own history).
- amuleSpecial(1)/(2): the shared-directory tree's folder icons get
  new "amule:folder"/"amule:folder_shared" SVGs -- same shape, tinted
  orange vs. red, matching how the original raw bitmaps only differed
  by colour.
- amuleSpecial(3)/(4): the chat/search notebook tabs' close-on-hover
  icon, replaced with wx's own stock wxART_CLOSE for both states
  instead of a second bespoke asset (both were the same "X in a box"
  bitmap, differing only by a hover-highlight border colour).

reload.svg's own history, per PR review: the first hand-drawn attempt
(thin blue single arc) didn't match the original at all -- got3nks
caught it, I reconstructed the original amuleDlgImages(18) raster to
check (a thicker green double-arrow circle) and redrew closer to that,
which still wasn't good enough. Final version is AI-vectorized via
Recraft (through the Higgsfield MCP), which got3nks preferred over
further hand-drawn iterations.

src/icons/icon_data.c (the checked-in fallback used when Python3 is
absent at configure time, per amule-project#487) regenerated via embed_icons.py to
match.

Rebased onto current master (picking up amule-project#732/amule-project#733/amule-project#739, which all
touch the same amuleSpecial/amuleDlgImages functions) -- conflicts
resolved by redoing the index deletions against the current tree
rather than replaying the stale patch, since amule-project#725/amule-project#733 already moved
the surrounding line numbers.

Verified via a full amule build (macOS) and a visual check of every
call site: Friends/Messages tab headers, the ED2K server-list and Kad
node-list reload buttons, the shared-files reload button, and the
Preferences > Directory shared-folder tree.

* fix(gui): thicker reload stroke, dedicated message-bubble icon (amule-project#735 review)

got3nks, testing amule-project#735:
- reload: arrow bodies read too thin at 16px. Regenerated via Recraft
  with an explicit thicker/bolder-stroke prompt.
- Messages panel header: reusing "amule:toolbar_messages" (the main
  toolbar's detailed gradient mascot bust) at 16x16 doesn't read as
  "messages" once shrunk that far from its 32x32 native size. Added a
  dedicated "amule:message" chat-bubble glyph instead, sized for
  legibility at 16x16 specifically, and pointed the Messages panel
  header at it instead of the toolbar art.

Folder/folder_shared and the tab-close X were already approved as-is.

Verified via a full amule build (macOS) and a visual check of both
fixes: the shared-files reload button and the Messages panel header.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant