Fix some potential overflow issues (#1161)

* Fix some potential overflow issues

Put sizeof to the beginning of the multiplication to enforce that
size_t instead of smaller integer types is used for the calculation.

This fixes warnings from LGTM:

    Multiplication result may overflow 'unsigned int'
    before it is converted to 'unsigned long'.

It also allows removing some type casts.

Signed-off-by: Stefan Weil <sw@weilnetz.de>

* Fix code indentation

Signed-off-by: Stefan Weil <sw@weilnetz.de>

4 files changed, 10 insertions, 10 deletions

diff --git a/src/lib/openjp2/jp2.c b/src/lib/openjp2/jp2.c
index 180a416b..4402ffe3 100644
--- a/src/lib/openjp2/jp2.c
+++ b/src/lib/openjp2/jp2.c
@@ -1079,7 +1079,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image,
 
         /* Palette mapping: */
         new_comps[i].data = (OPJ_INT32*)
-                            opj_image_data_alloc(old_comps[cmp].w * old_comps[cmp].h * sizeof(OPJ_INT32));
+                            opj_image_data_alloc(sizeof(OPJ_INT32) * old_comps[cmp].w * old_comps[cmp].h);
         if (!new_comps[i].data) {
             while (i > 0) {
                 -- i;
@@ -1193,8 +1193,8 @@ static OPJ_BOOL opj_jp2_read_pclr(opj_jp2_t *jp2,
         return OPJ_FALSE;
     }
 
-    entries = (OPJ_UINT32*) opj_malloc((size_t)nr_channels * nr_entries * sizeof(
-                                           OPJ_UINT32));
+    entries = (OPJ_UINT32*) opj_malloc(sizeof(OPJ_UINT32) * nr_channels *
+                                       nr_entries);
     if (!entries) {
         return OPJ_FALSE;
     }
diff --git a/src/lib/openjp2/t1.c b/src/lib/openjp2/t1.c
index 76744380..ec04c682 100644
--- a/src/lib/openjp2/t1.c
+++ b/src/lib/openjp2/t1.c
@@ -1618,8 +1618,8 @@ static void opj_t1_clbl_decode_processor(void* user_data, opj_tls_t* tls)
         cblk_w = (OPJ_UINT32)(cblk->x1 - cblk->x0);
         cblk_h = (OPJ_UINT32)(cblk->y1 - cblk->y0);
 
-        cblk->decoded_data = (OPJ_INT32*)opj_aligned_malloc(cblk_w * cblk_h * sizeof(
-                                 OPJ_INT32));
+        cblk->decoded_data = (OPJ_INT32*)opj_aligned_malloc(sizeof(OPJ_INT32) *
+                             cblk_w * cblk_h);
         if (cblk->decoded_data == NULL) {
             if (job->p_manager_mutex) {
                 opj_mutex_lock(job->p_manager_mutex);
@@ -1634,7 +1634,7 @@ static void opj_t1_clbl_decode_processor(void* user_data, opj_tls_t* tls)
             return;
         }
         /* Zero-init required */
-        memset(cblk->decoded_data, 0, cblk_w * cblk_h * sizeof(OPJ_INT32));
+        memset(cblk->decoded_data, 0, sizeof(OPJ_INT32) * cblk_w * cblk_h);
     } else if (cblk->decoded_data) {
         /* Not sure if that code path can happen, but better be */
         /* safe than sorry */
diff --git a/src/lib/openmj2/j2k.c b/src/lib/openmj2/j2k.c
index 85f7b40e..daf13f80 100644
--- a/src/lib/openmj2/j2k.c
+++ b/src/lib/openmj2/j2k.c
@@ -331,7 +331,7 @@ static int j2k_calculate_tp(opj_cp_t *cp, int img_numcomp, opj_image_t *image,
 
     OPJ_ARG_NOT_USED(img_numcomp);
 
-    j2k->cur_totnum_tp = (int *) opj_malloc(cp->tw * cp->th * sizeof(int));
+    j2k->cur_totnum_tp = (int *) opj_malloc(sizeof(int) * cp->tw * cp->th);
     for (tileno = 0; tileno < cp->tw * cp->th; tileno++) {
         int cur_totnum_tp = 0;
         opj_tcp_t *tcp = &cp->tcps[tileno];
@@ -611,7 +611,7 @@ static void j2k_read_siz(opj_j2k_t *j2k)
         opj_event_msg(j2k->cinfo, EVT_ERROR, "Out of memory\n");
         return;
     }
-    cp->tileno = (int*) opj_malloc(cp->tw * cp->th * sizeof(int));
+    cp->tileno = (int*) opj_malloc(sizeof(int) * cp->tw * cp->th);
     if (cp->tileno == NULL) {
         opj_event_msg(j2k->cinfo, EVT_ERROR, "Out of memory\n");
         return;
diff --git a/src/lib/openmj2/jp2.c b/src/lib/openmj2/jp2.c
index d2ca41f0..acf64b9a 100644
--- a/src/lib/openmj2/jp2.c
+++ b/src/lib/openmj2/jp2.c
@@ -393,7 +393,7 @@ static void jp2_apply_pclr(opj_jp2_color_t *color, opj_image_t *image,
         }
         /* Palette mapping: */
         new_comps[pcol].data = (int*)
-                               opj_malloc(old_comps[cmp].w * old_comps[cmp].h * sizeof(int));
+                               opj_malloc(sizeof(int) * old_comps[cmp].w * old_comps[cmp].h);
         new_comps[pcol].prec = channel_size[i];
         new_comps[pcol].sgnd = channel_sign[i];
     }
@@ -461,7 +461,7 @@ static opj_bool jp2_read_pclr(opj_jp2_t *jp2, opj_cio_t *cio,
     nr_channels = (unsigned short)cio_read(cio, 1);/* NPC */
 
     entries = (unsigned int*)
-              opj_malloc(nr_channels * nr_entries * sizeof(unsigned int));
+              opj_malloc(sizeof(unsigned int) * nr_channels * nr_entries);
     channel_size = (unsigned char*)opj_malloc(nr_channels);
     channel_sign = (unsigned char*)opj_malloc(nr_channels);