Repository navigation
Clarify sprite allocation sizes and restore Ruby scanning - #66
Merged
Merged
Conversation
decoder-dev
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make the sprite macroblock allocation count explicitly std::size_t before multiplying both dimensions, with the standard size-type header included. The first security PR widened these expressions with C-style casts; CodeQL’s no-build analysis still reported the two vector constructor expressions. Use one named wide count shared by both allocations, retaining the allocation sizes and behavior.
Restore the Ruby analysis configuration still present in the default-branch baseline. Ruby uses its own configuration: the codec-specific C/C++ exclusions previously hid the repository’s Ruby tool, leaving no Ruby source for the extractor. This restores active scanning instead of deleting the old analysis configuration.
The changed sprite_encode.cpp translation unit compiles locally. This follow-up remains a draft until the repeated C++ CodeQL analysis and the Apple Silicon native codec suite pass. The full native codec suite cannot build on this Linux x86 host because its existing SIMD implementation requires ARM NEON.
Final review: the repeated no-build analysis still treated the named size_t multiplication as int arithmetic (alert 1389). The actual compiled translation unit’s GIMPLE explicitly converts both hwm and hhm to unsigned long before multiplication; the ARM64 native suite also passes. This remaining report is individually dismissed as a verified false positive. No queries or source-scanning paths are disabled. Evidence is retained in the task’s sprite-allocation.gimple and triage record.