From cd3b2c2bea4b3523ccc41a3fca577bab49bc55cb Mon Sep 17 00:00:00 2001 From: Niklas Ye Date: Sun, 25 Oct 2026 08:46:35 +0100 Subject: [PATCH] Clamp the avatar scaler's channels before narrowing them gosec's G115 failed the security job on v0.50.0's first push: the box filter narrows uint64 channel sums to uint8. They cannot overflow, since a premultiplied channel never exceeds its alpha, but the conversion now goes through to8, which clamps to 16 bits first so that holds by construction rather than by argument. No behaviour change, and nothing else in the avatar work moves. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN --- internal/api/avatars.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/internal/api/avatars.go b/internal/api/avatars.go index 292a80a..31ae41f 100644 --- a/internal/api/avatars.go +++ b/internal/api/avatars.go @@ -95,12 +95,19 @@ func boxScale(img image.Image, src image.Rectangle, size int) *image.NRGBA { continue } r, g, b = r/cnt*0xffff/a, g/cnt*0xffff/a, b/cnt*0xffff/a - out.SetNRGBA(x, y, color.NRGBA{uint8(r >> 8), uint8(g >> 8), uint8(b >> 8), uint8(a >> 8)}) + out.SetNRGBA(x, y, color.NRGBA{to8(r), to8(g), to8(b), to8(a)}) } } return out } +// to8 narrows a 16-bit channel to 8 bits. The clamp is what makes the +// conversion safe by construction: a premultiplied channel never exceeds its +// alpha, so it is not expected to bite, but nothing here relies on that. +func to8(v uint64) uint8 { + return uint8(min(v, 0xffff) >> 8) +} + func handleGetAvatar(db *sql.DB) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)