Fix some potential overflows in shapeburst fill calculation

nyalldawson · github-actions[bot] · commit a8d25d6e3c72 · 2023-03-03T10:11:38.000Z
diff --git a/src/core/symbology/qgsfillsymbollayer.cpp b/src/core/symbology/qgsfillsymbollayer.cpp
@@ -1453,11 +1453,11 @@ void QgsShapeburstFillSymbolLayer::distanceTransform1d( double *f, int n, int *v
   z[1] = + INF;
   for ( int q = 1; q <= n - 1; q++ )
   {
-    double s  = ( ( f[q] + q * q ) - ( f[v[k]] + ( v[k] * v[k] ) ) ) / ( 2 * q - 2 * v[k] );
+    double s  = ( ( f[q] + static_cast< double >( q ) * q ) - ( f[v[k]] + ( static_cast< double >( v[k] ) * v[k] ) ) ) / ( 2 * q - 2 * v[k] );
     while ( s <= z[k] )
     {
       k--;
-      s  = ( ( f[q] + q * q ) - ( f[v[k]] + ( v[k] * v[k] ) ) ) / ( 2 * q - 2 * v[k] );
+      s  = ( ( f[q] + static_cast< double >( q ) * q ) - ( f[v[k]] + ( static_cast< double >( v[k] ) * v[k] ) ) ) / ( 2 * q - 2 * v[k] );
     }
     k++;
     v[k] = q;
@@ -1470,7 +1470,7 @@ void QgsShapeburstFillSymbolLayer::distanceTransform1d( double *f, int n, int *v
   {
     while ( z[k + 1] < q )
       k++;
-    d[q] = ( q - v[k] ) * ( q - v[k] ) + f[v[k]];
+    d[q] = static_cast< double >( q - v[k] ) * ( q - v[k] ) + f[v[k]];
   }
 }
 
@@ -1491,12 +1491,12 @@ void QgsShapeburstFillSymbolLayer::distanceTransform2d( double *im, int width, i
 
     for ( int y = 0; y < height; y++ )
     {
-      f[y] = im[ x + y * width ];
+      f[y] = im[ x + static_cast< std::size_t>( y ) * width ];
     }
     distanceTransform1d( f, height, v, z, d );
     for ( int y = 0; y < height; y++ )
     {
-      im[ x + y * width ] = d[y];
+      im[ x + static_cast< std::size_t>( y ) * width ] = d[y];
     }
   }
 
@@ -1508,12 +1508,12 @@ void QgsShapeburstFillSymbolLayer::distanceTransform2d( double *im, int width, i
 
     for ( int x = 0; x < width; x++ )
     {
-      f[x] = im[  x + y * width ];
+      f[x] = im[  x + static_cast< std::size_t>( y ) * width ];
     }
     distanceTransform1d( f, width, v, z, d );
     for ( int x = 0; x < width; x++ )
     {
-      im[  x + y * width ] = d[x];
+      im[  x + static_cast< std::size_t>( y ) * width ] = d[x];
     }
   }
 
@@ -1529,11 +1529,11 @@ double *QgsShapeburstFillSymbolLayer::distanceTransform( QImage *im, QgsRenderCo
   int width = im->width();
   int height = im->height();
 
-  double *dtArray = new double[width * height];
+  double *dtArray = new double[static_cast< std::size_t>( width ) * height];
 
   //load qImage to array
   QRgb tmpRgb;
-  int idx = 0;
+  std::size_t idx = 0;
   for ( int heightIndex = 0; heightIndex < height; ++heightIndex )
   {
     if ( context.renderingStopped() )
@@ -1575,7 +1575,7 @@ void QgsShapeburstFillSymbolLayer::dtArrayToQImage( double *array, QImage *im, Q
   {
     //no max distance specified in symbol properties, so calculate from maximum value in distance transform results
     double dtMaxValue = array[0];
-    for ( int i = 1; i < ( width * height ); ++i )
+    for ( std::size_t i = 1; i < static_cast< std::size_t >( width ) * height; ++i )
     {
       if ( array[i] > dtMaxValue )
       {
@@ -1593,7 +1593,7 @@ void QgsShapeburstFillSymbolLayer::dtArrayToQImage( double *array, QImage *im, Q
   }
 
   //update the pixels in the provided QImage
-  int idx = 0;
+  std::size_t idx = 0;
   double squaredVal = 0;
   double pixVal = 0;
 

Original file line number	Diff line number	Diff line change
`@@ -1453,11 +1453,11 @@ void QgsShapeburstFillSymbolLayer::distanceTransform1d( double f, int n, int v`
`1453`	`1453`	`z[1] = + INF;`
`1454`	`1454`	`for ( int q = 1; q <= n - 1; q++ )`
`1455`	`1455`	`{`
`1456`		`- double s = ( ( f[q] + q * q ) - ( f[v[k]] + ( v[k] * v[k] ) ) ) / ( 2 * q - 2 * v[k] );`
	`1456`	`+ double s = ( ( f[q] + static_cast< double >( q ) * q ) - ( f[v[k]] + ( static_cast< double >( v[k] ) * v[k] ) ) ) / ( 2 * q - 2 * v[k] );`
`1457`	`1457`	`while ( s <= z[k] )`
`1458`	`1458`	`{`
`1459`	`1459`	`k--;`
`1460`		`- s = ( ( f[q] + q * q ) - ( f[v[k]] + ( v[k] * v[k] ) ) ) / ( 2 * q - 2 * v[k] );`
	`1460`	`+ s = ( ( f[q] + static_cast< double >( q ) * q ) - ( f[v[k]] + ( static_cast< double >( v[k] ) * v[k] ) ) ) / ( 2 * q - 2 * v[k] );`
`1461`	`1461`	`}`
`1462`	`1462`	`k++;`
`1463`	`1463`	`v[k] = q;`
`@@ -1470,7 +1470,7 @@ void QgsShapeburstFillSymbolLayer::distanceTransform1d( double f, int n, int v`
`1470`	`1470`	`{`
`1471`	`1471`	`while ( z[k + 1] < q )`
`1472`	`1472`	`k++;`
`1473`		`- d[q] = ( q - v[k] ) * ( q - v[k] ) + f[v[k]];`
	`1473`	`+ d[q] = static_cast< double >( q - v[k] ) * ( q - v[k] ) + f[v[k]];`
`1474`	`1474`	`}`
`1475`	`1475`	`}`
`1476`	`1476`
`@@ -1491,12 +1491,12 @@ void QgsShapeburstFillSymbolLayer::distanceTransform2d( double *im, int width, i`
`1491`	`1491`
`1492`	`1492`	`for ( int y = 0; y < height; y++ )`
`1493`	`1493`	`{`
`1494`		`- f[y] = im[ x + y * width ];`
	`1494`	`+ f[y] = im[ x + static_cast< std::size_t>( y ) * width ];`
`1495`	`1495`	`}`
`1496`	`1496`	`distanceTransform1d( f, height, v, z, d );`
`1497`	`1497`	`for ( int y = 0; y < height; y++ )`
`1498`	`1498`	`{`
`1499`		`- im[ x + y * width ] = d[y];`
	`1499`	`+ im[ x + static_cast< std::size_t>( y ) * width ] = d[y];`
`1500`	`1500`	`}`
`1501`	`1501`	`}`
`1502`	`1502`
`@@ -1508,12 +1508,12 @@ void QgsShapeburstFillSymbolLayer::distanceTransform2d( double *im, int width, i`
`1508`	`1508`
`1509`	`1509`	`for ( int x = 0; x < width; x++ )`
`1510`	`1510`	`{`
`1511`		`- f[x] = im[ x + y * width ];`
	`1511`	`+ f[x] = im[ x + static_cast< std::size_t>( y ) * width ];`
`1512`	`1512`	`}`
`1513`	`1513`	`distanceTransform1d( f, width, v, z, d );`
`1514`	`1514`	`for ( int x = 0; x < width; x++ )`
`1515`	`1515`	`{`
`1516`		`- im[ x + y * width ] = d[x];`
	`1516`	`+ im[ x + static_cast< std::size_t>( y ) * width ] = d[x];`
`1517`	`1517`	`}`
`1518`	`1518`	`}`
`1519`	`1519`
`@@ -1529,11 +1529,11 @@ double QgsShapeburstFillSymbolLayer::distanceTransform( QImage im, QgsRenderCo`
`1529`	`1529`	`int width = im->width();`
`1530`	`1530`	`int height = im->height();`
`1531`	`1531`
`1532`		`- double dtArray = new double[width height];`
	`1532`	`+ double dtArray = new double[static_cast< std::size_t>( width ) height];`
`1533`	`1533`
`1534`	`1534`	`//load qImage to array`
`1535`	`1535`	`QRgb tmpRgb;`
`1536`		`- int idx = 0;`
	`1536`	`+ std::size_t idx = 0;`
`1537`	`1537`	`for ( int heightIndex = 0; heightIndex < height; ++heightIndex )`
`1538`	`1538`	`{`
`1539`	`1539`	`if ( context.renderingStopped() )`
`@@ -1575,7 +1575,7 @@ void QgsShapeburstFillSymbolLayer::dtArrayToQImage( double array, QImage im, Q`
`1575`	`1575`	`{`
`1576`	`1576`	`//no max distance specified in symbol properties, so calculate from maximum value in distance transform results`
`1577`	`1577`	`double dtMaxValue = array[0];`
`1578`		`- for ( int i = 1; i < ( width * height ); ++i )`
	`1578`	`+ for ( std::size_t i = 1; i < static_cast< std::size_t >( width ) * height; ++i )`
`1579`	`1579`	`{`
`1580`	`1580`	`if ( array[i] > dtMaxValue )`
`1581`	`1581`	`{`
`@@ -1593,7 +1593,7 @@ void QgsShapeburstFillSymbolLayer::dtArrayToQImage( double array, QImage im, Q`
`1593`	`1593`	`}`
`1594`	`1594`
`1595`	`1595`	`//update the pixels in the provided QImage`
`1596`		`- int idx = 0;`
	`1596`	`+ std::size_t idx = 0;`
`1597`	`1597`	`double squaredVal = 0;`
`1598`	`1598`	`double pixVal = 0;`
`1599`	`1599`