Herb Derby | 35ae65d | 2017-08-11 14:00:50 -0400 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2017 Google Inc. |
| 3 | * |
| 4 | * Use of this source code is governed by a BSD-style license that can be |
| 5 | * found in the LICENSE file. |
| 6 | */ |
| 7 | |
| 8 | #ifndef SkSafeMath_DEFINED |
| 9 | #define SkSafeMath_DEFINED |
| 10 | |
| 11 | // SkSafeMath always check that a series of operations do not overflow. |
| 12 | // This must be correct for all platforms, because this is a check for safety at runtime. |
| 13 | |
| 14 | class SkSafeMath { |
| 15 | public: |
| 16 | SkSafeMath() = default; |
| 17 | |
| 18 | bool ok() const { return fOK; } |
| 19 | explicit operator bool() const { return fOK; } |
| 20 | |
| 21 | size_t mul(size_t x, size_t y) { |
| 22 | return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y); |
| 23 | } |
| 24 | |
| 25 | size_t add(size_t x, size_t y) { |
| 26 | size_t result = x + y; |
| 27 | fOK &= result >= x; |
| 28 | return result; |
| 29 | } |
| 30 | |
Mike Reed | 67b190b | 2017-11-21 13:34:40 -0500 | [diff] [blame] | 31 | /** |
| 32 | * Return a + b, unless this result is an overflow/underflow. In those cases, fOK will |
| 33 | * be set to false, and it is undefined what this returns. |
| 34 | */ |
| 35 | int addInt(int a, int b) { |
| 36 | if (b < 0 && a < std::numeric_limits<int>::min() - b) { |
| 37 | fOK = false; |
| 38 | return a; |
| 39 | } else if (b > 0 && a > std::numeric_limits<int>::max() - b) { |
| 40 | fOK = false; |
| 41 | return a; |
| 42 | } |
| 43 | return a + b; |
| 44 | } |
| 45 | |
Florin Malita | d923a71 | 2017-11-22 10:11:12 -0500 | [diff] [blame] | 46 | size_t alignUp(size_t x, size_t alignment) { |
| 47 | SkASSERT(alignment && !(alignment & (alignment - 1))); |
| 48 | return add(x, alignment - 1) & ~(alignment - 1); |
| 49 | } |
| 50 | |
Mike Reed | 33f38b0 | 2018-02-14 13:58:06 -0500 | [diff] [blame^] | 51 | template <typename T> T castTo(size_t value) { |
| 52 | if (!SkTFitsIn<T>(value)) { |
| 53 | fOK = false; |
| 54 | } |
| 55 | return static_cast<T>(value); |
| 56 | } |
| 57 | |
Mike Reed | 5c68dce | 2017-12-21 21:54:32 -0500 | [diff] [blame] | 58 | // These saturate to their results |
| 59 | static size_t Add(size_t x, size_t y); |
| 60 | static size_t Mul(size_t x, size_t y); |
Mike Reed | baafcdc | 2018-01-22 13:34:53 -0500 | [diff] [blame] | 61 | static size_t Align4(size_t x) { |
| 62 | SkSafeMath safe; |
| 63 | return safe.alignUp(x, 4); |
| 64 | } |
Mike Reed | 5c68dce | 2017-12-21 21:54:32 -0500 | [diff] [blame] | 65 | |
Herb Derby | 35ae65d | 2017-08-11 14:00:50 -0400 | [diff] [blame] | 66 | private: |
| 67 | uint32_t mul32(uint32_t x, uint32_t y) { |
| 68 | uint64_t bx = x; |
| 69 | uint64_t by = y; |
| 70 | uint64_t result = bx * by; |
| 71 | fOK &= result >> 32 == 0; |
| 72 | return result; |
| 73 | } |
| 74 | |
| 75 | uint64_t mul64(uint64_t x, uint64_t y) { |
| 76 | if (x <= std::numeric_limits<uint64_t>::max() >> 32 |
| 77 | && y <= std::numeric_limits<uint64_t>::max() >> 32) { |
| 78 | return x * y; |
| 79 | } else { |
| 80 | auto hi = [](uint64_t x) { return x >> 32; }; |
| 81 | auto lo = [](uint64_t x) { return x & 0xFFFFFFFF; }; |
| 82 | |
| 83 | uint64_t lx_ly = lo(x) * lo(y); |
| 84 | uint64_t hx_ly = hi(x) * lo(y); |
| 85 | uint64_t lx_hy = lo(x) * hi(y); |
| 86 | uint64_t hx_hy = hi(x) * hi(y); |
| 87 | uint64_t result = 0; |
| 88 | result = this->add(lx_ly, (hx_ly << 32)); |
| 89 | result = this->add(result, (lx_hy << 32)); |
| 90 | fOK &= (hx_hy + (hx_ly >> 32) + (lx_hy >> 32)) == 0; |
| 91 | |
| 92 | #if defined(SK_DEBUG) && defined(__clang__) && defined(__x86_64__) |
| 93 | auto double_check = (unsigned __int128)x * y; |
| 94 | SkASSERT(result == (double_check & 0xFFFFFFFFFFFFFFFF)); |
| 95 | SkASSERT(!fOK || (double_check >> 64 == 0)); |
| 96 | #endif |
| 97 | |
| 98 | return result; |
| 99 | } |
| 100 | } |
| 101 | bool fOK = true; |
| 102 | }; |
| 103 | |
| 104 | #endif//SkSafeMath_DEFINED |