ENH: Make the 64-to-32 bit truncations explicit - #131
Open
hjmjohnson wants to merge 2 commits into
Open
hjmjohnson wants to merge 2 commits into
hjmjohnson wants to merge 2 commits into
Conversation
modify_all_fields() and modify_field() wrote into a caller-supplied buffer at an offset taken from the field table, with no way to check that the write stayed inside it. Both now take the buffer size, and modify_field() rejects a field whose offset plus size * len exceeds it. The check sits ahead of the switch, so it covers every write path rather than the string case alone, and it reports and returns like the other failures in the function; an assert() would compile away in the release builds that ship. No field table can trip it today: check_total_size() already requires the offsets to tile the structure exactly. It bounds future edits to them. (cherry picked from commit 7356eb1)
31 -Wshorten-64-to-32 warnings. Most were benign; one was not.
FslSeekVolume() declared `int offset` and assigned it a byte position
into the image file:
offset = fslio->niftiptr->iname_offset
+ vols * FslGetVolSize(fslio) * fslio->niftiptr->nbyper;
return znzseek(fslio->fileptr, offset, SEEK_SET);
Seek to any volume past 2GB and the multiplication overflows, so znzseek
-- which takes a 64-bit znz_off_t -- receives a wrong and quite possibly
negative position. offset is a local, so widening it to znz_off_t and
widening the operands changes no interface. FslReadVolumes' volbytes had
the same shape and is now size_t.
The rest fall into two groups. Internal helpers were widened to carry
the value they were already being handed: nifti_read_extensions() and
rci_alloc_mem() now return int64_t rather than truncating their own
results, and nifti_read_next_extension() and nifti_check_extension() take
an int64_t `remain`. nt_read_bricks(), declared in the uninstalled
nifti_tool.h, takes an int64_t length.
Where the narrowing target is an installed prototype it can only be made
explicit, so each such cast carries a note: nifti_image_load_bricks()
returning a brick count as int, nifti_read_subregion_image() returning a
byte count as int, nifti_read_ascii_image() taking an int header length,
and FslSeekVolume()'s int return. The remainder are strlen() results
assigned to int and fread()/znzread() counts, bounded by buffers a few
hundred bytes long.
Two format strings were widened to PRId64 to match the parameters that
changed.
(cherry picked from commit 08c5f80)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-submission of #52, reverted from
masteron 2026-09-24. Content isunchanged from the original.
Position 9 of 11 in the deep stack. Base:
stack/pr-fix-calloc-transposed-args.Based on the pull request above it in the stack, so the diff shown here is
this change alone. Merge the stack bottom-up.
Stack order
stack/test-regression-coveragemasterstack/pr-fix-alloc-null-checksstack/test-regression-coveragestack/fix-axml-skip-depthstack/pr-fix-alloc-null-checksstack/pr-fix-analyzer-leaksstack/fix-axml-skip-depthstack/pr-fix-sign-conversionstack/pr-fix-analyzer-leaksstack/fix-fslio-64bit-arithmeticstack/pr-fix-sign-conversionstack/fix-cifti-null-streamstack/fix-fslio-64bit-arithmeticstack/pr-fix-calloc-transposed-argsstack/fix-cifti-null-streamstack/pr-fix-shorten-64-to-32<- this PRstack/pr-fix-calloc-transposed-argsstack/fix-image-read-complex-checkstack/pr-fix-shorten-64-to-32stack/pr-fix-xml-read-errorsstack/fix-image-read-complex-checkThe order is the order these changes sat on
masterbefore the revert, soit builds and tests at every step.
Commits introduced by this PR
Ordering for all the re-submitted work is tracked in #84.