Potential fix for code scanning alert no. 2257: Multiplication result converted to larger type

[Bryan-Roe]

Potential fix for https://github.com/Bryan-Roe/Aria/security/code-scanning/2257

To fix this class of issue, ensure multiplication is performed in the destination wider type (size_t) by casting operands before multiplying.

Best fix here (without changing functionality): in pxt_modules/screen/image.cpp, inside scroll() at the dx < 0 branch, change the memmove length argument from (w - dx) * bh to static_cast<size_t>(w - dx) * static_cast<size_t>(bh). This mirrors the existing safe style already used at line 514 and keeps logic identical.

No new methods or dependencies are needed; no imports are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

---

Note

Low Risk
Single-line, behavior-preserving type cast in image scrolling; no API or logic changes.

Overview
Addresses a code scanning warning in horizontal scroll() when shifting pixels left (dx < 0).

The memmove byte count is now computed as static_cast<size_t>(w - dx) * static_cast<size_t>(bh) instead of (w - dx) * bh, so the multiply happens in size_t rather than int before being passed to memmove. This matches the pattern already used on the dx > 0 memset path and does not change scroll behavior.

^{Reviewed by Cursor Bugbot for commit 4cdfca3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

@Bryan-Roe Thanks for sending me some feedback. Unfortunately, I hit an error while trying to use the custom Copilot setup steps configured for this repository. The error I am seeing is:

no `copilot-setup-steps` job found in your `copilot-setup-steps.yml` workflow file. Please ensure you have a single job named `copilot-setup-steps`. For more details, see https://gh.io/copilot/actions-setup-steps

Once you or someone with the necessary access fixes the problem, please let me know in a comment and I'll try again. Thanks!

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3e2a09bf-8599-49da-bea0-80d6f21668ec)

[Copilot]

Pull request overview

Ensures the scroll() byte-count multiplication occurs in size_t, addressing CodeQL alert 2257 without changing behavior.

Changes:

• Casts both multiplication operands before calling memmove.
• Matches the existing safe casting pattern in the same function.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_bb5a9583-a923-4eba-aae2-ce14f12fd302)