Herb Derby | 35ae65d | 2017-08-11 14:00:50 -0400 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2017 Google Inc. |
| 3 | * |
| 4 | * Use of this source code is governed by a BSD-style license that can be |
| 5 | * found in the LICENSE file. |
| 6 | */ |
| 7 | |
| 8 | #ifndef SkSafeMath_DEFINED |
| 9 | #define SkSafeMath_DEFINED |
| 10 | |
Mike Reed | 267eccc | 2018-02-21 15:55:14 -0500 | [diff] [blame] | 11 | #include "SkTypes.h" |
Mike Klein | bf45c70 | 2018-06-11 11:56:57 -0400 | [diff] [blame^] | 12 | #include <limits> |
Mike Reed | 267eccc | 2018-02-21 15:55:14 -0500 | [diff] [blame] | 13 | |
Herb Derby | 35ae65d | 2017-08-11 14:00:50 -0400 | [diff] [blame] | 14 | // SkSafeMath always check that a series of operations do not overflow. |
| 15 | // This must be correct for all platforms, because this is a check for safety at runtime. |
| 16 | |
| 17 | class SkSafeMath { |
| 18 | public: |
| 19 | SkSafeMath() = default; |
| 20 | |
| 21 | bool ok() const { return fOK; } |
| 22 | explicit operator bool() const { return fOK; } |
| 23 | |
| 24 | size_t mul(size_t x, size_t y) { |
| 25 | return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y); |
| 26 | } |
| 27 | |
| 28 | size_t add(size_t x, size_t y) { |
| 29 | size_t result = x + y; |
| 30 | fOK &= result >= x; |
| 31 | return result; |
| 32 | } |
| 33 | |
Mike Reed | 67b190b | 2017-11-21 13:34:40 -0500 | [diff] [blame] | 34 | /** |
| 35 | * Return a + b, unless this result is an overflow/underflow. In those cases, fOK will |
| 36 | * be set to false, and it is undefined what this returns. |
| 37 | */ |
| 38 | int addInt(int a, int b) { |
| 39 | if (b < 0 && a < std::numeric_limits<int>::min() - b) { |
| 40 | fOK = false; |
| 41 | return a; |
| 42 | } else if (b > 0 && a > std::numeric_limits<int>::max() - b) { |
| 43 | fOK = false; |
| 44 | return a; |
| 45 | } |
| 46 | return a + b; |
| 47 | } |
| 48 | |
Florin Malita | d923a71 | 2017-11-22 10:11:12 -0500 | [diff] [blame] | 49 | size_t alignUp(size_t x, size_t alignment) { |
| 50 | SkASSERT(alignment && !(alignment & (alignment - 1))); |
| 51 | return add(x, alignment - 1) & ~(alignment - 1); |
| 52 | } |
| 53 | |
Mike Reed | 33f38b0 | 2018-02-14 13:58:06 -0500 | [diff] [blame] | 54 | template <typename T> T castTo(size_t value) { |
| 55 | if (!SkTFitsIn<T>(value)) { |
| 56 | fOK = false; |
| 57 | } |
| 58 | return static_cast<T>(value); |
| 59 | } |
| 60 | |
Mike Reed | 5c68dce | 2017-12-21 21:54:32 -0500 | [diff] [blame] | 61 | // These saturate to their results |
| 62 | static size_t Add(size_t x, size_t y); |
| 63 | static size_t Mul(size_t x, size_t y); |
Mike Reed | baafcdc | 2018-01-22 13:34:53 -0500 | [diff] [blame] | 64 | static size_t Align4(size_t x) { |
| 65 | SkSafeMath safe; |
| 66 | return safe.alignUp(x, 4); |
| 67 | } |
Mike Reed | 5c68dce | 2017-12-21 21:54:32 -0500 | [diff] [blame] | 68 | |
Herb Derby | 35ae65d | 2017-08-11 14:00:50 -0400 | [diff] [blame] | 69 | private: |
| 70 | uint32_t mul32(uint32_t x, uint32_t y) { |
| 71 | uint64_t bx = x; |
| 72 | uint64_t by = y; |
| 73 | uint64_t result = bx * by; |
| 74 | fOK &= result >> 32 == 0; |
| 75 | return result; |
| 76 | } |
| 77 | |
| 78 | uint64_t mul64(uint64_t x, uint64_t y) { |
| 79 | if (x <= std::numeric_limits<uint64_t>::max() >> 32 |
| 80 | && y <= std::numeric_limits<uint64_t>::max() >> 32) { |
| 81 | return x * y; |
| 82 | } else { |
| 83 | auto hi = [](uint64_t x) { return x >> 32; }; |
| 84 | auto lo = [](uint64_t x) { return x & 0xFFFFFFFF; }; |
| 85 | |
| 86 | uint64_t lx_ly = lo(x) * lo(y); |
| 87 | uint64_t hx_ly = hi(x) * lo(y); |
| 88 | uint64_t lx_hy = lo(x) * hi(y); |
| 89 | uint64_t hx_hy = hi(x) * hi(y); |
| 90 | uint64_t result = 0; |
| 91 | result = this->add(lx_ly, (hx_ly << 32)); |
| 92 | result = this->add(result, (lx_hy << 32)); |
| 93 | fOK &= (hx_hy + (hx_ly >> 32) + (lx_hy >> 32)) == 0; |
| 94 | |
| 95 | #if defined(SK_DEBUG) && defined(__clang__) && defined(__x86_64__) |
| 96 | auto double_check = (unsigned __int128)x * y; |
| 97 | SkASSERT(result == (double_check & 0xFFFFFFFFFFFFFFFF)); |
| 98 | SkASSERT(!fOK || (double_check >> 64 == 0)); |
| 99 | #endif |
| 100 | |
| 101 | return result; |
| 102 | } |
| 103 | } |
| 104 | bool fOK = true; |
| 105 | }; |
| 106 | |
| 107 | #endif//SkSafeMath_DEFINED |