1 /* 2 * Copyright 2017 Google Inc. 3 * 4 * Use of this source code is governed by a BSD-style license that can be 5 * found in the LICENSE file. 6 */ 7 8 #ifndef SkSafeMath_DEFINED 9 #define SkSafeMath_DEFINED 10 11 #include "include/private/base/SkAssert.h" 12 #include "include/private/base/SkDebug.h" // IWYU pragma: keep 13 #include "include/private/base/SkTFitsIn.h" 14 15 #include <cstddef> 16 #include <cstdint> 17 #include <limits> 18 19 // SkSafeMath always check that a series of operations do not overflow. 20 // This must be correct for all platforms, because this is a check for safety at runtime. 21 22 class SkSafeMath { 23 public: 24 SkSafeMath() = default; 25 ok()26 bool ok() const { return fOK; } 27 explicit operator bool() const { return fOK; } 28 mul(size_t x,size_t y)29 size_t mul(size_t x, size_t y) { 30 return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y); 31 } 32 add(size_t x,size_t y)33 size_t add(size_t x, size_t y) { 34 size_t result = x + y; 35 fOK &= result >= x; 36 return result; 37 } 38 39 /** 40 * Return a + b, unless this result is an overflow/underflow. In those cases, fOK will 41 * be set to false, and it is undefined what this returns. 42 */ addInt(int a,int b)43 int addInt(int a, int b) { 44 if (b < 0 && a < std::numeric_limits<int>::min() - b) { 45 fOK = false; 46 return a; 47 } else if (b > 0 && a > std::numeric_limits<int>::max() - b) { 48 fOK = false; 49 return a; 50 } 51 return a + b; 52 } 53 alignUp(size_t x,size_t alignment)54 size_t alignUp(size_t x, size_t alignment) { 55 SkASSERT(alignment && !(alignment & (alignment - 1))); 56 return add(x, alignment - 1) & ~(alignment - 1); 57 } 58 castTo(TSrc value)59 template <typename TDst, typename TSrc> TDst castTo(TSrc value) { 60 if (!SkTFitsIn<TDst, TSrc>(value)) { 61 fOK = false; 62 } 63 return static_cast<TDst>(value); 64 } 65 66 // These saturate to their results 67 static size_t Add(size_t x, size_t y); 68 static size_t Mul(size_t x, size_t y); Align4(size_t x)69 static size_t Align4(size_t x) { 70 SkSafeMath safe; 71 return safe.alignUp(x, 4); 72 } 73 74 private: mul32(uint32_t x,uint32_t y)75 uint32_t mul32(uint32_t x, uint32_t y) { 76 uint64_t bx = x; 77 uint64_t by = y; 78 uint64_t result = bx * by; 79 fOK &= result >> 32 == 0; 80 // Overflow information is capture in fOK. Return the result modulo 2^32. 81 return (uint32_t)result; 82 } 83 mul64(uint64_t x,uint64_t y)84 uint64_t mul64(uint64_t x, uint64_t y) { 85 if (x <= std::numeric_limits<uint64_t>::max() >> 32 86 && y <= std::numeric_limits<uint64_t>::max() >> 32) { 87 return x * y; 88 } else { 89 auto hi = [](uint64_t x) { return x >> 32; }; 90 auto lo = [](uint64_t x) { return x & 0xFFFFFFFF; }; 91 92 uint64_t lx_ly = lo(x) * lo(y); 93 uint64_t hx_ly = hi(x) * lo(y); 94 uint64_t lx_hy = lo(x) * hi(y); 95 uint64_t hx_hy = hi(x) * hi(y); 96 uint64_t result = 0; 97 result = this->add(lx_ly, (hx_ly << 32)); 98 result = this->add(result, (lx_hy << 32)); 99 fOK &= (hx_hy + (hx_ly >> 32) + (lx_hy >> 32)) == 0; 100 101 #if defined(SK_DEBUG) && defined(__clang__) && defined(__x86_64__) 102 auto double_check = (unsigned __int128)x * y; 103 SkASSERT(result == (double_check & 0xFFFFFFFFFFFFFFFF)); 104 SkASSERT(!fOK || (double_check >> 64 == 0)); 105 #endif 106 107 return result; 108 } 109 } 110 bool fOK = true; 111 }; 112 113 #endif//SkSafeMath_DEFINED 114