1*946379e7Schristos /* xsize.h -- Checked size_t computations.
2*946379e7Schristos
3*946379e7Schristos Copyright (C) 2003 Free Software Foundation, Inc.
4*946379e7Schristos
5*946379e7Schristos This program is free software; you can redistribute it and/or modify
6*946379e7Schristos it under the terms of the GNU General Public License as published by
7*946379e7Schristos the Free Software Foundation; either version 2, or (at your option)
8*946379e7Schristos any later version.
9*946379e7Schristos
10*946379e7Schristos This program is distributed in the hope that it will be useful,
11*946379e7Schristos but WITHOUT ANY WARRANTY; without even the implied warranty of
12*946379e7Schristos MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13*946379e7Schristos GNU General Public License for more details.
14*946379e7Schristos
15*946379e7Schristos You should have received a copy of the GNU General Public License
16*946379e7Schristos along with this program; if not, write to the Free Software Foundation,
17*946379e7Schristos Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */
18*946379e7Schristos
19*946379e7Schristos #ifndef _XSIZE_H
20*946379e7Schristos #define _XSIZE_H
21*946379e7Schristos
22*946379e7Schristos /* Get size_t. */
23*946379e7Schristos #include <stddef.h>
24*946379e7Schristos
25*946379e7Schristos /* Get SIZE_MAX. */
26*946379e7Schristos #include <limits.h>
27*946379e7Schristos #if HAVE_STDINT_H
28*946379e7Schristos # include <stdint.h>
29*946379e7Schristos #endif
30*946379e7Schristos
31*946379e7Schristos /* The size of memory objects is often computed through expressions of
32*946379e7Schristos type size_t. Example:
33*946379e7Schristos void* p = malloc (header_size + n * element_size).
34*946379e7Schristos These computations can lead to overflow. When this happens, malloc()
35*946379e7Schristos returns a piece of memory that is way too small, and the program then
36*946379e7Schristos crashes while attempting to fill the memory.
37*946379e7Schristos To avoid this, the functions and macros in this file check for overflow.
38*946379e7Schristos The convention is that SIZE_MAX represents overflow.
39*946379e7Schristos malloc (SIZE_MAX) is not guaranteed to fail -- think of a malloc
40*946379e7Schristos implementation that uses mmap --, it's recommended to use size_overflow_p()
41*946379e7Schristos or size_in_bounds_p() before invoking malloc().
42*946379e7Schristos The example thus becomes:
43*946379e7Schristos size_t size = xsum (header_size, xtimes (n, element_size));
44*946379e7Schristos void *p = (size_in_bounds_p (size) ? malloc (size) : NULL);
45*946379e7Schristos */
46*946379e7Schristos
47*946379e7Schristos /* Convert an arbitrary value >= 0 to type size_t. */
48*946379e7Schristos #define xcast_size_t(N) \
49*946379e7Schristos ((N) <= SIZE_MAX ? (size_t) (N) : SIZE_MAX)
50*946379e7Schristos
51*946379e7Schristos /* Sum of two sizes, with overflow check. */
52*946379e7Schristos static inline size_t
53*946379e7Schristos #if __GNUC__ >= 3
54*946379e7Schristos __attribute__ ((__pure__))
55*946379e7Schristos #endif
xsum(size_t size1,size_t size2)56*946379e7Schristos xsum (size_t size1, size_t size2)
57*946379e7Schristos {
58*946379e7Schristos size_t sum = size1 + size2;
59*946379e7Schristos return (sum >= size1 ? sum : SIZE_MAX);
60*946379e7Schristos }
61*946379e7Schristos
62*946379e7Schristos /* Sum of three sizes, with overflow check. */
63*946379e7Schristos static inline size_t
64*946379e7Schristos #if __GNUC__ >= 3
65*946379e7Schristos __attribute__ ((__pure__))
66*946379e7Schristos #endif
xsum3(size_t size1,size_t size2,size_t size3)67*946379e7Schristos xsum3 (size_t size1, size_t size2, size_t size3)
68*946379e7Schristos {
69*946379e7Schristos return xsum (xsum (size1, size2), size3);
70*946379e7Schristos }
71*946379e7Schristos
72*946379e7Schristos /* Sum of four sizes, with overflow check. */
73*946379e7Schristos static inline size_t
74*946379e7Schristos #if __GNUC__ >= 3
75*946379e7Schristos __attribute__ ((__pure__))
76*946379e7Schristos #endif
xsum4(size_t size1,size_t size2,size_t size3,size_t size4)77*946379e7Schristos xsum4 (size_t size1, size_t size2, size_t size3, size_t size4)
78*946379e7Schristos {
79*946379e7Schristos return xsum (xsum (xsum (size1, size2), size3), size4);
80*946379e7Schristos }
81*946379e7Schristos
82*946379e7Schristos /* Maximum of two sizes, with overflow check. */
83*946379e7Schristos static inline size_t
84*946379e7Schristos #if __GNUC__ >= 3
85*946379e7Schristos __attribute__ ((__pure__))
86*946379e7Schristos #endif
xmax(size_t size1,size_t size2)87*946379e7Schristos xmax (size_t size1, size_t size2)
88*946379e7Schristos {
89*946379e7Schristos /* No explicit check is needed here, because for any n:
90*946379e7Schristos max (SIZE_MAX, n) == SIZE_MAX and max (n, SIZE_MAX) == SIZE_MAX. */
91*946379e7Schristos return (size1 >= size2 ? size1 : size2);
92*946379e7Schristos }
93*946379e7Schristos
94*946379e7Schristos /* Multiplication of a count with an element size, with overflow check.
95*946379e7Schristos The count must be >= 0 and the element size must be > 0.
96*946379e7Schristos This is a macro, not an inline function, so that it works correctly even
97*946379e7Schristos when N is of a wider tupe and N > SIZE_MAX. */
98*946379e7Schristos #define xtimes(N, ELSIZE) \
99*946379e7Schristos ((N) <= SIZE_MAX / (ELSIZE) ? (size_t) (N) * (ELSIZE) : SIZE_MAX)
100*946379e7Schristos
101*946379e7Schristos /* Check for overflow. */
102*946379e7Schristos #define size_overflow_p(SIZE) \
103*946379e7Schristos ((SIZE) == SIZE_MAX)
104*946379e7Schristos /* Check against overflow. */
105*946379e7Schristos #define size_in_bounds_p(SIZE) \
106*946379e7Schristos ((SIZE) != SIZE_MAX)
107*946379e7Schristos
108*946379e7Schristos #endif /* _XSIZE_H */
109