1 /*
2  * Copyright 2017 Google Inc.
3  *
4  * Use of this source code is governed by a BSD-style license that can be
5  * found in the LICENSE file.
6  */
7 
8 #ifndef SkSafeMath_DEFINED
9 #define SkSafeMath_DEFINED
10 
11 #include "include/core/SkTypes.h"
12 #include "include/private/SkTFitsIn.h"
13 #include <limits>
14 
15 // SkSafeMath always check that a series of operations do not overflow.
16 // This must be correct for all platforms, because this is a check for safety at runtime.
17 
18 class SkSafeMath {
19 public:
20     SkSafeMath() = default;
21 
ok()22     bool ok() const { return fOK; }
23     explicit operator bool() const { return fOK; }
24 
mul(size_t x,size_t y)25     size_t mul(size_t x, size_t y) {
26         return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y);
27     }
28 
add(size_t x,size_t y)29     size_t add(size_t x, size_t y) {
30         size_t result = x + y;
31         fOK &= result >= x;
32         return result;
33     }
34 
35     /**
36      *  Return a + b, unless this result is an overflow/underflow. In those cases, fOK will
37      *  be set to false, and it is undefined what this returns.
38      */
addInt(int a,int b)39     int addInt(int a, int b) {
40         if (b < 0 && a < std::numeric_limits<int>::min() - b) {
41             fOK = false;
42             return a;
43         } else if (b > 0 && a > std::numeric_limits<int>::max() - b) {
44             fOK = false;
45             return a;
46         }
47         return a + b;
48     }
49 
alignUp(size_t x,size_t alignment)50     size_t alignUp(size_t x, size_t alignment) {
51         SkASSERT(alignment && !(alignment & (alignment - 1)));
52         return add(x, alignment - 1) & ~(alignment - 1);
53     }
54 
castTo(size_t value)55     template <typename T> T castTo(size_t value) {
56         if (!SkTFitsIn<T>(value)) {
57             fOK = false;
58         }
59         return static_cast<T>(value);
60     }
61 
62     // These saturate to their results
63     static size_t Add(size_t x, size_t y);
64     static size_t Mul(size_t x, size_t y);
Align4(size_t x)65     static size_t Align4(size_t x) {
66         SkSafeMath safe;
67         return safe.alignUp(x, 4);
68     }
69 
70 private:
mul32(uint32_t x,uint32_t y)71     uint32_t mul32(uint32_t x, uint32_t y) {
72         uint64_t bx = x;
73         uint64_t by = y;
74         uint64_t result = bx * by;
75         fOK &= result >> 32 == 0;
76         return result;
77     }
78 
mul64(uint64_t x,uint64_t y)79     uint64_t mul64(uint64_t x, uint64_t y) {
80         if (x <= std::numeric_limits<uint64_t>::max() >> 32
81             && y <= std::numeric_limits<uint64_t>::max() >> 32) {
82             return x * y;
83         } else {
84             auto hi = [](uint64_t x) { return x >> 32; };
85             auto lo = [](uint64_t x) { return x & 0xFFFFFFFF; };
86 
87             uint64_t lx_ly = lo(x) * lo(y);
88             uint64_t hx_ly = hi(x) * lo(y);
89             uint64_t lx_hy = lo(x) * hi(y);
90             uint64_t hx_hy = hi(x) * hi(y);
91             uint64_t result = 0;
92             result = this->add(lx_ly, (hx_ly << 32));
93             result = this->add(result, (lx_hy << 32));
94             fOK &= (hx_hy + (hx_ly >> 32) + (lx_hy >> 32)) == 0;
95 
96             #if defined(SK_DEBUG) && defined(__clang__) && defined(__x86_64__)
97                 auto double_check = (unsigned __int128)x * y;
98                 SkASSERT(result == (double_check & 0xFFFFFFFFFFFFFFFF));
99                 SkASSERT(!fOK || (double_check >> 64 == 0));
100             #endif
101 
102             return result;
103         }
104     }
105     bool fOK = true;
106 };
107 
108 #endif//SkSafeMath_DEFINED
109