1*a1acfa9bSespie /* xsize.h -- Checked size_t computations.
2*a1acfa9bSespie
3*a1acfa9bSespie Copyright (C) 2003 Free Software Foundation, Inc.
4*a1acfa9bSespie
5*a1acfa9bSespie This program is free software; you can redistribute it and/or modify it
6*a1acfa9bSespie under the terms of the GNU Library General Public License as published
7*a1acfa9bSespie by the Free Software Foundation; either version 2, or (at your option)
8*a1acfa9bSespie any later version.
9*a1acfa9bSespie
10*a1acfa9bSespie This program is distributed in the hope that it will be useful,
11*a1acfa9bSespie but WITHOUT ANY WARRANTY; without even the implied warranty of
12*a1acfa9bSespie MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13*a1acfa9bSespie Library General Public License for more details.
14*a1acfa9bSespie
15*a1acfa9bSespie You should have received a copy of the GNU Library General Public
16*a1acfa9bSespie License along with this program; if not, write to the Free Software
17*a1acfa9bSespie Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
18*a1acfa9bSespie USA. */
19*a1acfa9bSespie
20*a1acfa9bSespie #ifndef _XSIZE_H
21*a1acfa9bSespie #define _XSIZE_H
22*a1acfa9bSespie
23*a1acfa9bSespie /* Get size_t. */
24*a1acfa9bSespie #include <stddef.h>
25*a1acfa9bSespie
26*a1acfa9bSespie /* Get SIZE_MAX. */
27*a1acfa9bSespie #include <limits.h>
28*a1acfa9bSespie #if HAVE_STDINT_H
29*a1acfa9bSespie # include <stdint.h>
30*a1acfa9bSespie #endif
31*a1acfa9bSespie
32*a1acfa9bSespie /* The size of memory objects is often computed through expressions of
33*a1acfa9bSespie type size_t. Example:
34*a1acfa9bSespie void* p = malloc (header_size + n * element_size).
35*a1acfa9bSespie These computations can lead to overflow. When this happens, malloc()
36*a1acfa9bSespie returns a piece of memory that is way too small, and the program then
37*a1acfa9bSespie crashes while attempting to fill the memory.
38*a1acfa9bSespie To avoid this, the functions and macros in this file check for overflow.
39*a1acfa9bSespie The convention is that SIZE_MAX represents overflow.
40*a1acfa9bSespie malloc (SIZE_MAX) is not guaranteed to fail -- think of a malloc
41*a1acfa9bSespie implementation that uses mmap --, it's recommended to use size_overflow_p()
42*a1acfa9bSespie or size_in_bounds_p() before invoking malloc().
43*a1acfa9bSespie The example thus becomes:
44*a1acfa9bSespie size_t size = xsum (header_size, xtimes (n, element_size));
45*a1acfa9bSespie void *p = (size_in_bounds_p (size) ? malloc (size) : NULL);
46*a1acfa9bSespie */
47*a1acfa9bSespie
48*a1acfa9bSespie /* Convert an arbitrary value >= 0 to type size_t. */
49*a1acfa9bSespie #define xcast_size_t(N) \
50*a1acfa9bSespie ((N) <= SIZE_MAX ? (size_t) (N) : SIZE_MAX)
51*a1acfa9bSespie
52*a1acfa9bSespie /* Sum of two sizes, with overflow check. */
53*a1acfa9bSespie static inline size_t
54*a1acfa9bSespie #if __GNUC__ >= 3
55*a1acfa9bSespie __attribute__ ((__pure__))
56*a1acfa9bSespie #endif
xsum(size_t size1,size_t size2)57*a1acfa9bSespie xsum (size_t size1, size_t size2)
58*a1acfa9bSespie {
59*a1acfa9bSespie size_t sum = size1 + size2;
60*a1acfa9bSespie return (sum >= size1 ? sum : SIZE_MAX);
61*a1acfa9bSespie }
62*a1acfa9bSespie
63*a1acfa9bSespie /* Sum of three sizes, with overflow check. */
64*a1acfa9bSespie static inline size_t
65*a1acfa9bSespie #if __GNUC__ >= 3
66*a1acfa9bSespie __attribute__ ((__pure__))
67*a1acfa9bSespie #endif
xsum3(size_t size1,size_t size2,size_t size3)68*a1acfa9bSespie xsum3 (size_t size1, size_t size2, size_t size3)
69*a1acfa9bSespie {
70*a1acfa9bSespie return xsum (xsum (size1, size2), size3);
71*a1acfa9bSespie }
72*a1acfa9bSespie
73*a1acfa9bSespie /* Sum of four sizes, with overflow check. */
74*a1acfa9bSespie static inline size_t
75*a1acfa9bSespie #if __GNUC__ >= 3
76*a1acfa9bSespie __attribute__ ((__pure__))
77*a1acfa9bSespie #endif
xsum4(size_t size1,size_t size2,size_t size3,size_t size4)78*a1acfa9bSespie xsum4 (size_t size1, size_t size2, size_t size3, size_t size4)
79*a1acfa9bSespie {
80*a1acfa9bSespie return xsum (xsum (xsum (size1, size2), size3), size4);
81*a1acfa9bSespie }
82*a1acfa9bSespie
83*a1acfa9bSespie /* Maximum of two sizes, with overflow check. */
84*a1acfa9bSespie static inline size_t
85*a1acfa9bSespie #if __GNUC__ >= 3
86*a1acfa9bSespie __attribute__ ((__pure__))
87*a1acfa9bSespie #endif
xmax(size_t size1,size_t size2)88*a1acfa9bSespie xmax (size_t size1, size_t size2)
89*a1acfa9bSespie {
90*a1acfa9bSespie /* No explicit check is needed here, because for any n:
91*a1acfa9bSespie max (SIZE_MAX, n) == SIZE_MAX and max (n, SIZE_MAX) == SIZE_MAX. */
92*a1acfa9bSespie return (size1 >= size2 ? size1 : size2);
93*a1acfa9bSespie }
94*a1acfa9bSespie
95*a1acfa9bSespie /* Multiplication of a count with an element size, with overflow check.
96*a1acfa9bSespie The count must be >= 0 and the element size must be > 0.
97*a1acfa9bSespie This is a macro, not an inline function, so that it works correctly even
98*a1acfa9bSespie when N is of a wider tupe and N > SIZE_MAX. */
99*a1acfa9bSespie #define xtimes(N, ELSIZE) \
100*a1acfa9bSespie ((N) <= SIZE_MAX / (ELSIZE) ? (size_t) (N) * (ELSIZE) : SIZE_MAX)
101*a1acfa9bSespie
102*a1acfa9bSespie /* Check for overflow. */
103*a1acfa9bSespie #define size_overflow_p(SIZE) \
104*a1acfa9bSespie ((SIZE) == SIZE_MAX)
105*a1acfa9bSespie /* Check against overflow. */
106*a1acfa9bSespie #define size_in_bounds_p(SIZE) \
107*a1acfa9bSespie ((SIZE) != SIZE_MAX)
108*a1acfa9bSespie
109*a1acfa9bSespie #endif /* _XSIZE_H */
110