Skip to content

BUG: Fix selected ImageProcessing numeric conversions and ranges - #1888

Draft
jmarquisbq wants to merge 130 commits into
BlueQuartzSoftware:developfrom
jmarquisbq:fix/unsafe-numeric-conversions-1874
Draft

BUG: Fix selected ImageProcessing numeric conversions and ranges#1888
jmarquisbq wants to merge 130 commits into
BlueQuartzSoftware:developfrom
jmarquisbq:fix/unsafe-numeric-conversions-1874

Conversation

@jmarquisbq

@jmarquisbq jmarquisbq commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Draft: merge the OOC foundation dependencies and validate the coordinated branch pair before merging.

Summary

Correct unsafe conversions and range calculations in 18 ImageProcessing filters. The selected scope addresses 19 of the 46 C15 findings; 21 filters and 27 findings remain open. The C15 increment is 81 files changed, +12,376 / -990 lines, relative to the required OOC foundation. The current comparison with develop also includes that unmerged foundation: 276 files changed, +44,501 / -2,647 lines.

Required dependencies and coordinated merge

Review companion

Download the HTML review companion. Download review-companion.html and open it locally to use its search and collapsed details.

Each filter has a TL;DR, the reviewed baseline, the selected contract, alternatives, rationale, migration effects and verification limits. The same document retains the 21 deferred filters. The remaining C15 decisions and implementations are outside this scope. Issue 1874 must stay open.

1. Preserve mathematical results and check integer limits

  • Update the nine math filters: Acos, Asin, Exp, ExpNegative, Log, Log10, Sqrt, Square and Tan.
  • Map integer Acos, Asin and Tan inputs to float32 output. Map integer Exp, ExpNegative, Log, Log10 and Sqrt inputs to float64 output. Retain existing floating output types.
  • Widen smaller integer Square outputs exactly. Reject signed or unsigned 64-bit multiplication overflow before multiplication.
  • Use src/Plugins/ImageProcessing/src/ImageProcessing/utils/MathOutputUtilities.hpp for the selected output conversions.

The help explains why each output type changes, its precision and storage costs, and downstream effects. Integer-only consumers can reject promoted arrays. Preserved fractions and nonfinite values can change later thresholds and segmentation.

2. Check morphology and smoothing conversions

  • Preserve native integer Height arithmetic in HConvex and HMinima. Reject fractional integer Heights and report HConvex contrast overflow.
  • Check final CurvatureFlow and SmoothingRecursiveGaussian conversions. Truncate finite integer results, clip when required, and report nonfinite integer results as errors.
  • Use src/simplnx/Utilities/ImageProcessing/TerminalImageConversion.hpp for shared conversion decisions. Retain the selected working precision and existing unrelated helper defaults.

The help describes clipping warnings, precision limits, migration choices and the existing cancellation-warning boundary. No fixed process-memory cap is claimed.

3. Make segmentation and export policies explicit

  • Add default Error and explicit Warn choices for ConnectedComponent provisional-ID overflow and MorphologicalWatershedFromMarkers marker conversion.
  • Validate the Otsu uint8 label interval. Add nonfinite handling, an optional bool/uint8 mask and a distinct excluded label. Check unusable histogram and solver arithmetic.
  • Correct ThresholdMaximumConnectedComponents midpoint and interval arithmetic. Check Upper Boundary before conversion, preserve the two-unit stopping tolerance, and apply the approved nonfinite and empty-band fallbacks.
  • Check WriteImage color-export ranges before writing slices. Add the approved nonfinite choices and mask behavior. Preserve raw export behavior.

The midpoint correction changes 159 pixels in the RA-Float regression: foreground changes from 99,487 to 99,328, and components change from 3,715 to 3,712. Both old and corrected references remain active. A separate six-neighbor flood fill establishes the migration. The retained heuristic does not guarantee a global optimum.

Test plan

  • Both integrated Windows Release ALL_BUILD builds pass with the paired source heads.
  • All 1,445 InCore and 1,651 OOC ImageProcessing CTest cases pass serially.
  • Literal mathematical values, native integer bounds, independent masks, decoded RGB values and file-preservation checks pass.
  • The selected disk-backed, mixed-mask, low-grant, cancellation and injected I/O-failure regressions pass.
  • The changed C++ files pass clang-format 19.1.1 with their repository styles.
  • The rebased coordinated pair passes supported-platform CI before merge.

Configured clang-tidy runs remain nonpassing with recorded triage. Debug, sanitizer, cross-platform, installed-SDK, measured peak-memory and formal all-input scientific certification are not claimed. The greater-than-2^32 provisional-run boundary uses direct capacity tests and small consequence models; a full-size forest was not created. Browser layout was not verified; HTML structure and offline controls passed.

Related Issue

Related to #1874

Related to #1870

@jmarquisbq jmarquisbq self-assigned this Oct 27, 2026
jmarquisbq and others added 29 commits October 28, 2026 12:02
@jmarquisbq
BUG: Preserve cumulative parallel storage requirements
eab8494 
Keep parallel execution disabled after an earlier storage requirement or
explicit disable. Preserve the explicit enable call as the reset point.

Add regression cases for both helpers, mixed calls, empty/null inputs,
and the multicore enable/reset behavior.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve array selection storage constraints
9502eaa 
Retain storage location when cloning an array parameter and accept
explicit matching in-memory and out-of-core stores. Keep metadata-only
and string-array behavior unchanged, with readable mismatch diagnostics.

Add the location and clone regression matrix.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Validate KMeans cluster counts and default to one
6f76b9b 
Use one cluster by default and reject explicit zero during preflight and
both algorithm entry points before output changes or data access.

Update parameter help and contracts, and add literal one-cluster and
unchanged-output regressions for the direct and scanline paths.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Report checked store flush failures
42248cf 
Add const checked flush methods for numeric stores, list stores, data objects,
and data structures while retaining the existing void APIs. Forward each
object once and retain ordered warnings, backend error codes, object IDs,
and every object path. Classify allocation failures as -272 and preserve
invalid results that have no error diagnostic.

Add regression coverage for legacy adapters, missing stores, shared stores,
multiple parents, exceptions, diagnostic ordering, and later-object visits.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Report pipeline completion and recovery write failures
4c61ae6 
Use checked flushes at filter completion and retain original diagnostics.
Prepare snapshots before replacing prior results, report final snapshot
failures, and preserve completion failure during cancellation and retry.
Carry warnings through the HDF5 writer chain and expose root errors to
CLI observers. Add focused pipeline and command-line regression cases.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
ENH: Add caller-owned HDF5 chunk-shape scratch
3d76500 
* Add a nonallocating chunk-shape entry point with explicit output and
  suffix storage so callers can include policy scratch in their budget.
* Keep the existing vector API on the same arithmetic and cover both
  policies, literal shapes, and rejected span boundaries.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Validate HDF5 write selections before transfer
613273d 
* Reject invalid ranks, bounds, products, and input spans before selecting
  or writing a dataset region, preserving existing values on rejection.
* Keep empty simple selections, surplus input prefixes, primitive
  conversions, and valid unlinked-open dataset writes supported.
* Guard local dataspaces and report file, dataset, selection, and native
  failure details outside the HDF5 API lock.
* Cover all exported primitive types, boundary and native-write errors,
  and real sparse metadata that reaches both arithmetic overflow guards.

Validation: paired Release simplnx_test builds; 18 focused cases and
3 additional lock controls in each configuration. The final stronger
arithmetic assertions also pass in both builds.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Plan selected imports against the complete destination
c6211d6 
Read policy-neutral cached metadata, stage the complete selection, and
resolve destination storage before loading selected values. Preserve
per-path copies for multi-parent sources and use checked identifiers and
exact-object cleanup when publication fails.

Add cache, filter, legacy, finalizer, identifier, and rollback regressions.
Full paired consumer builds passed, with 98 in-memory cases and 432 OOC
cases across the coordinated import and storage verification.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Check Avizo output and close streams on failure
b870ff1 
Report failed writes, flushes, and closes before publishing an Avizo
export. Close the output stream on failed reads and exceptions, while
preserving earlier errors and warnings and the existing file format.

Cover both real filter wrappers and injected output failures, including
destination preservation and one consuming close on each exit path.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Add budgeted numeric extent reads for sampled ranges
6eb1a4c 
* Validate caller-owned extents and native chunk metadata before reading.
* Bound codec buffers, decoder state and diagnostics under one allowance
  while preserving the existing reader and compressed-stream behavior.
* Coalesce contiguous source/output copies and cover bounds, failures,
  sparse data, physical component splits and payload ownership.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Validate OOC thresholds and retain startup corrections
64cc60c 
* Reject invalid threshold values before changing preferences and repair
  only invalid saved fields with their original value and default context.
* Retain correction batches for one startup consumer. Preserve exact JSON
  values and key presence in shared, algorithm and benchmark scopes.
* Report CLI corrections before overrides and preflight, with owned-profile
  checks for malformed values, zero, maximum values and normal saving.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
PERF: Batch Identify Sample YZ transfers
4ddcb33 
* Reuse XY transfers across up to eight YZ slices within the admitted
  extra memory, with a one-slice fallback when no extra memory is free.
* Preserve completed slices and ordered error details on cancellation
  or failure, and reject invalid slice sizes before allocation.
* Add focused output, ownership, failure, and opt-in timing checks.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
COMP: Use aggregate initialization for the Avizo test handler
6f01a1c 
Preserve the existing no-op callback while fixing the unsupported
implicit conversion from a lambda reported by Clang.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
COMP: Avoid inherited field shadowing in Avizo writer tests
a2ac458 
Rename the write callback parameter while retaining its signature,
values, and overflow assertions. This fixes Clang shadow-all builds.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
COMP: Make Identify Sample test fixture types explicit
b721029 
Use the factories' concrete DataStructure return type in templated
helpers, so member template calls do not depend on auto deduction.
Keep test data, scenarios, assertions, and benchmark settings unchanged.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@imikejackson @jmarquisbq
COMP: Fix Linux compiler error
743bd3f 
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @jmarquisbq
COMP: Fix compiler warning in MacOS.
fea2914
@imikejackson @jmarquisbq
COMP: Avoid streaming file-clock durations in import tests
3ecbad1 
Evaluate both timestamp comparisons as boolean expressions before Catch2 processes them. This prevents unsupported __int128 duration streaming on macOS and preserves comparison precision.

Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @jmarquisbq
TEST: Match recovery warnings to import validation order
dc46b5b 
Require the recovery warning only after array materialization.
Check that rejected imports preserve destination paths, object IDs,
the next ID, and the existing group identity.

Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @jmarquisbq
TEST: Fix failing CI Test
1fc1d6c
@imikejackson @claude @jmarquisbq
COMP: Accept reviewed Apple libc++ 18.1 for bounded reads
eb75eab 
AppleClang 16 (Xcode MacOSX15.2.sdk) ships libc++ 180100, which the reviewed-configuration gate rejected, so every bounded read refused on macOS. Its counted vector allocation, empty-control, move and string-reserve representations were reviewed against the SDK headers and fit the existing bounds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @claude @jmarquisbq
TEST: Guard bounded result access before front()
b839590 
Require the expected error or warning count before dereferencing front() so a refused bounded read fails the test instead of crashing it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @claude @jmarquisbq
COMP: Accept reviewed GCC 11.4 libstdc++ for bounded reads
c5e2e5f 
CI Linux agents build with GCC 11.4 (Ubuntu 22.04), which the reviewed-configuration gate rejected, so bounded-read tests failed on Linux. GCC 11.4 libstdc++ was reviewed against its headers: counted vector allocation, fresh string reserve, moves and the sizeof-based bounds all fit the existing GCC 14 bounds. Verified natively with g++-11.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @claude @jmarquisbq
PERF: Bulk-load Laplacian Smoothing data for out-of-core stores
354c266 
edgeBasedSmoothing() read and wrote vertices and edges one element at a time, so every access went through the out-of-core chunk loader. With forced out-of-core storage the Porosity Mesh Export and Small IN100 Smooth Mesh pipelines timed out after 1500 s in CI. Copy the vertices, edges and node types into local buffers once, smooth in memory, and write the vertices back once. Results are bit-identical; the Porosity smoothing step now takes 13 s under forced out-of-core storage.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @claude @jmarquisbq
TEST: Stop running network-dependent citation check in CTest
8356a73 
VerifyExamplePipelineCitations resolves every citation over the network, so it depends on external services and each agent's certificate store (it failed on the Windows agent with CERTIFICATE_VERIFY_FAILED). Keep the script for manual runs when citations change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @claude @jmarquisbq
PERF: Add a block-sequential out-of-core path for triangle normals
e5844b4 
CalculateNormalsImpl read connectivity and vertices and wrote normals one element at a time, so with out-of-core stores every access went through the chunk loader and the Small IN100 Mesh Statistics pipeline timed out after 1500 s. Dispatch to a block-sequential path when any store is out of core: load the vertex coordinates once, then read connectivity and write normals in 262,144-triangle blocks. The in-core parallel path is unchanged and the normal math is identical. Compute Triangle Normals now takes under 1 s under forced out-of-core storage.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @claude @jmarquisbq
PERF: Add a block-sequential out-of-core path for triangle dihedral a…
7cdbf80 
…ngles

Under forced out-of-core storage the Small IN100 Mesh Statistics pipeline spent 55+ minutes in this filter. Dispatch to a block-sequential path when any involved store is out of core: load the vertex coordinates once, read connectivity and write angles in 262,144-triangle blocks. The in-core parallel path and the arithmetic are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @claude @jmarquisbq
PERF: Add a block-sequential out-of-core path for face IPF coloring
9d418d6 
Same per-element out-of-core access pattern as the triangle dihedral angle filter. Stream the per-face arrays in 262,144-triangle blocks and cache the feature and ensemble arrays once. Colors for unsupported crystal structures are preserved as before. The in-core path is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
@imikejackson @claude @jmarquisbq
PERF: Add a block-sequential out-of-core path for feature face misori…
a47fc17 
…entation

Same per-element out-of-core access pattern as the triangle dihedral angle filter. Stream face labels and misorientations in 262,144-triangle blocks and cache the feature and ensemble arrays once. The in-core path is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Michael Jackson <mike.jackson@bluequartz.net>
jmarquisbq and others added 29 commits October 28, 2026 12:04
@jmarquisbq
REV: Use standard arrays for hexadecimal lookup tables
67bdc2c 
Replace both built-in lookup arrays with std::to_array. Keep the same
characters, trailing null byte, and bounded diagnostic behavior.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
TEST: Avoid shadowing the saved resolver capture
ec235c1 
Rename the scope guard capture to avoid the AppleClang shadow warning.
Keep the shared owner, move operation, and resolver restoration
unchanged.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
REV: Use pointer suffixes in selected-import tests
3aa2129 
Use the project pointer naming convention for six local variables
in the two selected-import policy tests. Preserve their lookups,
ownership checks, and expected results.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
REV: Keep import publication and rollback in DataStructure
96a0a69 
Replace private import access with owner-controlled publication.
Validate selected paths, identifiers, and parent/name placements
before mutation. Release action planning sets before publication.
Keep exact-object rollback, identifier reservation, notifications,
and allocation-free warning transfer together. Add literal ownership,
admission, rollback, warning, and checkpoint regression checks.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
STY: Declare special members for new core helpers
8b5304d 
Declare the missing special members for core and test helpers.
Preserve constructor availability, ownership, and exception behavior.
Keep source state when rvalue construction must retain copy behavior.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@joeykleingers @jmarquisbq
REV: Address review findings for the OOC review fixes
98022e9 
* Identify Sample: in YZ mode with out-of-core storage, publish the
  first batch without extra planes. The first write to an imported
  read-only mask can need working memory from the same allowance as
  the extra planes.
* Triangle normals: for out-of-core output, compute and write the
  normal of triangle 0 before the compute reservation is kept, then
  reserve and plan again. Failures of that step use the new codes
  -65817, -65818 and -65819. Cancellation after that write stops
  before the next reservation.
* DataStructure::flushChecked() stops at the first object that fails
  and returns its errors with the warnings collected before it. Later
  objects keep their unwritten changes.
* Accept Apple libc++ 220106 (Xcode 27.0) in
  DiagnosticRepresentationSupported() after a review of its headers.
* Use std::unique_ptr<std::vector<T>> buffers in Compute Feature
  Centroids and Verify Triangle Winding.

Signed-off-by: Joey Kleingers <joey.kleingers@bluequartz.net>
@jmarquisbq
BUG: Preserve fractional angles in AcosImageFilter
86bf155 
Return float32 for integer input so fractional radians and NaN can
be stored. Retain floating input types and array shapes.

Document the type change and downstream effects. Add independent
numeric checks and coverage for disk-backed arrays.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve fractional angles in AsinImageFilter
d53d58d 
Return float32 for integer input so fractional radians and NaN can
be stored. Retain floating input types and array shapes.

Document the precision, storage and downstream effects. Add independent
principal-angle checks and tests for multi-component arrays.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve Exp range and fractional results for integer input
6d8660b 
Use float64 output for integer input and preserve existing floating types.
Handle float32 overflow before narrowing and document storage, precision,
underflow and downstream mask changes. Add independent boundary and shape
checks. Paired Release builds and 16 in-core / 20 disk-configuration cases pass.
Configured clang-tidy remains nonpassing on existing/shared diagnostics;
source review and clang-format 19.1.1 checks pass.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve negative exponential range for integer input
df9b14c 
Use float64 output for integer input and retain existing floating types.
Convert before negation and handle float32 overflow explicitly. Document
precision, storage, underflow and downstream mask changes. Paired Release
builds and 15 in-core / 20 disk-configuration tests pass. Source review and
clang-format 19.1.1 pass; configured static checks retain existing diagnostics.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve natural logarithm results for integer input
f91fb6c 
Produce float64 for integer inputs while preserving floating input types.
Keep IEEE domain outcomes and document precision, storage and downstream
changes. Add independent logarithm identities, native limits, floating
boundaries and shape tests. Paired Release builds and 15 in-core / 17
disk-configuration cases pass. Source review and clang-format pass;
configured static checks retain documented existing and oracle diagnostics.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
DOC: Clarify Exp pointwise buffer limits
56682c1 
Document the existing 64 MiB scratch target and minimum complete storage
slab. A slab can exceed the target or contain the full array. The filter
adds no separate full-volume calculation buffer. Numeric code and tests
are unchanged; source review verified the statement against the engine.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
DOC: Clarify ExpNegative pointwise buffer limits
1919df7 
Document the existing 64 MiB scratch target and minimum complete storage
slab. A slab can exceed the target or contain the full array. The filter
adds no separate full-volume calculation buffer. Numeric code and tests
are unchanged; source review verified the statement against the engine.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
DOC: Clarify Log pointwise buffer limits
8bc5874 
Document the existing 64 MiB scratch target and minimum complete storage
slab. A slab can exceed the target or contain the full array. The filter
adds no separate full-volume calculation buffer. Numeric code and tests
are unchanged; source review verified the statement against the engine.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve decimal logarithm results for integer input
de22b5e 
Use float64 for integer input and retain floating input types and IEEE
domain behavior. Document precision, storage, downstream effects and
the inherited transfer-buffer slab limit. Independent boundary and shape
tests pass in paired Release builds: 15 in-core and 17 OOC cases. Source
review and clang-format pass; configured static checks retain documented
existing/shared diagnostics.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve fractional square roots for integer input
54ac544 
Use float64 for integer input and retain floating input types and IEEE
domain behavior. Document precision, storage, downstream effects and
the inherited transfer-buffer slab limit. Independent boundary and shape
tests pass in paired Release builds: 15 in-core and 17 OOC cases. Source
review and clang-format pass; configured static checks retain documented
existing/shared diagnostics.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve signed fractional tangent results
840eeb0 
Map integer input to float32 and retain existing floating types. Keep IEEE
edge behavior and the existing double-argument precision limit. Document
the accuracy/storage tradeoff, downstream effects and buffer slab minimum.

Paired Release builds and 12 in-core / 14 OOC cases pass. Source review
and clang-format 19.1.1 pass. Configured static checks remain nonpassing
with documented existing/shared or intentional signed-widening diagnostics.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Widen integer squares and reject 64-bit overflow
fce4b40 
Use exact native integer products with the approved widening map. Check
signed and unsigned 64-bit bounds before multiplication through a native
extrema scan. Retain floating types with checked overflow conversion.
Document type mapping, limits, scan cost and migration.

Paired Release builds and 12 in-core / 17 OOC cases pass. Source review
and clang-format 19.1.1 pass. Configured static checks remain nonpassing
with documented existing/shared or intentional signed-widening diagnostics.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve native HConvex markers and check signed contrast
85dfb9e 
Reject fractional Height for integer images and lower integer markers with
exact saturating arithmetic. Check signed contrast before subtraction.
Keep output types and floating behavior. Shared exact-height capability is
opt-in; existing callers retain their defaults. Document migration and limits.

Paired full Release builds pass, with 55 in-core / 63 OOC HConvex cases and
40 / 46 shared-caller controls. Source review and clang-format pass.
Configured static checks remain nonpassing on documented existing,
framework and owned-buffer/numeric diagnostics.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Preserve native HMinima intensities and Height offsets
15742d2 
Require whole Height for integer images and opt into exact native marker
raising with safe saturation. Preserve floating fractions and output types.
Document intensity output, Float64 Height limits, migration and memory routes.

Paired full Release builds and final refreshes pass: 48 in-core / 73 OOC
HMinima cases, plus 40 / 46 shared-caller controls. Source review and
clang-format pass. Configured static checks remain nonpassing on documented
existing/shared/framework diagnostics.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Check Curvature Flow terminal numeric conversions
c355d34 
Validate active controls and copy native values exactly for zero operations. Check final integer conversion after truncation, report clipping once, and reject nonfinite integer results while retaining floating behavior and float64 evolution.

Cover resident, tiled and plane routes, warning propagation, transfer failures and cancellation. Explain precision limits and downstream clipping effects in the filter help.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Check recursive Gaussian smoothing conversions
5bb3ee0 
Validate active controls, effective scale and formed coefficients. Preserve signed output types, Float32 inter-pass values and existing recurrence order while checking final integer conversion and making floating narrowing explicit.

Retain one clipping warning through selected sinks and later failures. Cover native endpoints, precision, transfers and bounded routes, and explain the limits in the filter help.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Guard Connected Component provisional label capacity
4e50e76 
Default to an execution error before creating an ID above UINT32_MAX. Offer explicit legacy continuation with one immediate and retained warning while preserving uint32 labels, strict shared counting and existing allocation fallback.

Check all creation sites and warning lifetime. Cover native boundary decisions, small zero/reuse models, exact label maps and failure paths; document migration, memory costs and unreliable legacy output.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Guard watershed marker ID conversion
620c3d8 
Add Error and legacy warning choices before marker flooding. Preserve exact native diagnostics, marker output types, bounded copy routes and delivered phase warnings. Add independent native seed, transfer-failure and disk-route checks, and document migration and downstream effects.

Validated paired full Windows Release builds, 28 InCore and 33 OOC cases, plus 17/19 related watershed checks. Source review and clang-format 19.1.1 pass. Configured clang-tidy remains nonpassing; existing/framework diagnostics and four nonblocking style findings are recorded for final review. Debug and cross-platform checks were not run.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Validate Otsu numeric input and add explicit masks
e681834 
Add Error and Warn nonfinite handling, linked bool/uint8 masking, distinct excluded labels and checked uint8 class intervals. Preserve selected nonfinite endpoint frequencies, ordinary finite solver behavior and native output labels. Guard unusable geometry and objective arithmetic, retain bounded parallel range scans and document migration and downstream effects.

Validated full paired Windows Release builds, 29 InCore and 33 OOC cases plus 9 HistogramEngine controls in each. Independent literal and rational expectations include the demonstrated first-centroid regression. Source review and clang-format 19.1.1 pass. Configured clang-tidy remains nonpassing with documented framework and style diagnostics. Debug, cross-platform, installed SDK and universal scientific validation are not claimed.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Guard nonfinite color exports and native normalization
b164422 
Add linked Error and Warn choices for unmasked nonfinite color-table input. Validate the global range before committing any slice, preserve masked finite range values and raw writing, and use writer-scoped native-distance and scaled floating normalization. Document first-color fallback, migration, precision and per-slice failure limits.

Validated paired full Windows Release builds and 58 InCore/62 OOC cases. Independent decoded RGB, native/subnormal interiors, raw floating files, slice layouts, all-slice sentinel preservation, I/O failures and real disk/mixed backing pass. Source review and clang-format 19.1.1 pass. Configured clang-tidy remains nonpassing with documented existing/framework and lexical diagnostics; Debug, cross-platform and measured peak memory are not claimed.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Correct threshold search arithmetic and nonfinite handling
d670697 
Use native safe midpoints and spans, clamp upper controls before conversion, and add one explicit Error/Warn image policy. Preserve the two-unit stop, strict component counting and existing scoring. Define empty/no-finite fallbacks and rounded-state warnings, retain bounded parallel scans and document segmentation migration.

Validated paired full Windows Release builds, 40 InCore/48 OOC owning cases and 42/54 related controls. Independent native masks, actual disk/tile/3-D routes and failures pass. The float real-image regression actively retains legacy and corrected literal references; separate face-connected flood fill isolates the approved seed correction and 159 changed pixels. Source/fix review and clang-format 19.1.1 pass. Configured clang-tidy remains nonpassing; Debug, cross-platform, installed SDK and universal scientific proof are not claimed.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
BUG: Clarify ImageProcessing numeric migration help
2f4aa58 
Describe the public cancellation limit on smoothing warnings and qualify
Otsu label compatibility when numeric checks reject a finite calculation.

Validation: source-aligned scoped review and documentation checks passed.
The unchanged numeric code passed paired full Release builds and all
ImageProcessing cases: 1445 InCore and 1651 OOC.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
DOC: Complete ImageProcessing numeric helper contracts
decbffd 
Document template and parameter roles, output state, threshold caller
preconditions, cancellation results and existing numerical rationale.
Executable C++ tokens and API signatures are unchanged.

Validation: exact clang-format 19.1.1, lexical token comparison and
independent local review passed. New and changed comment blocks have no
audit findings; unchanged older comments remain outside this correction.
The unchanged numerical code passed 516 InCore and 611 OOC test cases.

Signed-off-by: Jessica Marquis <jessica.marquis@bluequartz.net>
@jmarquisbq
jmarquisbq force-pushed the fix/unsafe-numeric-conversions-1874 branch from 46f07c0 to decbffd Compare October 28, 2026 19:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@jmarquisbq jmarquisbq

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jmarquisbq @imikejackson @joeykleingers