1*2ddaa231Sotto /* xsize.h -- Checked size_t computations.
2*2ddaa231Sotto
3*2ddaa231Sotto Copyright (C) 2003 Free Software Foundation, Inc.
4*2ddaa231Sotto
5*2ddaa231Sotto This program is free software; you can redistribute it and/or modify
6*2ddaa231Sotto it under the terms of the GNU General Public License as published by
7*2ddaa231Sotto the Free Software Foundation; either version 2, or (at your option)
8*2ddaa231Sotto any later version.
9*2ddaa231Sotto
10*2ddaa231Sotto This program is distributed in the hope that it will be useful,
11*2ddaa231Sotto but WITHOUT ANY WARRANTY; without even the implied warranty of
12*2ddaa231Sotto MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13*2ddaa231Sotto GNU General Public License for more details.
14*2ddaa231Sotto
15*2ddaa231Sotto You should have received a copy of the GNU General Public License
16*2ddaa231Sotto along with this program; if not, write to the Free Software Foundation,
17*2ddaa231Sotto Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */
18*2ddaa231Sotto
19*2ddaa231Sotto #ifndef _XSIZE_H
20*2ddaa231Sotto #define _XSIZE_H
21*2ddaa231Sotto
22*2ddaa231Sotto /* Get size_t. */
23*2ddaa231Sotto #include <stddef.h>
24*2ddaa231Sotto
25*2ddaa231Sotto /* Get SIZE_MAX. */
26*2ddaa231Sotto #include <limits.h>
27*2ddaa231Sotto #if HAVE_STDINT_H
28*2ddaa231Sotto # include <stdint.h>
29*2ddaa231Sotto #endif
30*2ddaa231Sotto
31*2ddaa231Sotto /* The size of memory objects is often computed through expressions of
32*2ddaa231Sotto type size_t. Example:
33*2ddaa231Sotto void* p = malloc (header_size + n * element_size).
34*2ddaa231Sotto These computations can lead to overflow. When this happens, malloc()
35*2ddaa231Sotto returns a piece of memory that is way too small, and the program then
36*2ddaa231Sotto crashes while attempting to fill the memory.
37*2ddaa231Sotto To avoid this, the functions and macros in this file check for overflow.
38*2ddaa231Sotto The convention is that SIZE_MAX represents overflow.
39*2ddaa231Sotto malloc (SIZE_MAX) is not guaranteed to fail -- think of a malloc
40*2ddaa231Sotto implementation that uses mmap --, it's recommended to use size_overflow_p()
41*2ddaa231Sotto or size_in_bounds_p() before invoking malloc().
42*2ddaa231Sotto The example thus becomes:
43*2ddaa231Sotto size_t size = xsum (header_size, xtimes (n, element_size));
44*2ddaa231Sotto void *p = (size_in_bounds_p (size) ? malloc (size) : NULL);
45*2ddaa231Sotto */
46*2ddaa231Sotto
47*2ddaa231Sotto /* Convert an arbitrary value >= 0 to type size_t. */
48*2ddaa231Sotto #define xcast_size_t(N) \
49*2ddaa231Sotto ((N) <= SIZE_MAX ? (size_t) (N) : SIZE_MAX)
50*2ddaa231Sotto
51*2ddaa231Sotto /* Sum of two sizes, with overflow check. */
52*2ddaa231Sotto static inline size_t
53*2ddaa231Sotto #if __GNUC__ >= 3
54*2ddaa231Sotto __attribute__ ((__pure__))
55*2ddaa231Sotto #endif
xsum(size_t size1,size_t size2)56*2ddaa231Sotto xsum (size_t size1, size_t size2)
57*2ddaa231Sotto {
58*2ddaa231Sotto size_t sum = size1 + size2;
59*2ddaa231Sotto return (sum >= size1 ? sum : SIZE_MAX);
60*2ddaa231Sotto }
61*2ddaa231Sotto
62*2ddaa231Sotto /* Sum of three sizes, with overflow check. */
63*2ddaa231Sotto static inline size_t
64*2ddaa231Sotto #if __GNUC__ >= 3
65*2ddaa231Sotto __attribute__ ((__pure__))
66*2ddaa231Sotto #endif
xsum3(size_t size1,size_t size2,size_t size3)67*2ddaa231Sotto xsum3 (size_t size1, size_t size2, size_t size3)
68*2ddaa231Sotto {
69*2ddaa231Sotto return xsum (xsum (size1, size2), size3);
70*2ddaa231Sotto }
71*2ddaa231Sotto
72*2ddaa231Sotto /* Sum of four sizes, with overflow check. */
73*2ddaa231Sotto static inline size_t
74*2ddaa231Sotto #if __GNUC__ >= 3
75*2ddaa231Sotto __attribute__ ((__pure__))
76*2ddaa231Sotto #endif
xsum4(size_t size1,size_t size2,size_t size3,size_t size4)77*2ddaa231Sotto xsum4 (size_t size1, size_t size2, size_t size3, size_t size4)
78*2ddaa231Sotto {
79*2ddaa231Sotto return xsum (xsum (xsum (size1, size2), size3), size4);
80*2ddaa231Sotto }
81*2ddaa231Sotto
82*2ddaa231Sotto /* Maximum of two sizes, with overflow check. */
83*2ddaa231Sotto static inline size_t
84*2ddaa231Sotto #if __GNUC__ >= 3
85*2ddaa231Sotto __attribute__ ((__pure__))
86*2ddaa231Sotto #endif
xmax(size_t size1,size_t size2)87*2ddaa231Sotto xmax (size_t size1, size_t size2)
88*2ddaa231Sotto {
89*2ddaa231Sotto /* No explicit check is needed here, because for any n:
90*2ddaa231Sotto max (SIZE_MAX, n) == SIZE_MAX and max (n, SIZE_MAX) == SIZE_MAX. */
91*2ddaa231Sotto return (size1 >= size2 ? size1 : size2);
92*2ddaa231Sotto }
93*2ddaa231Sotto
94*2ddaa231Sotto /* Multiplication of a count with an element size, with overflow check.
95*2ddaa231Sotto The count must be >= 0 and the element size must be > 0.
96*2ddaa231Sotto This is a macro, not an inline function, so that it works correctly even
97*2ddaa231Sotto when N is of a wider tupe and N > SIZE_MAX. */
98*2ddaa231Sotto #define xtimes(N, ELSIZE) \
99*2ddaa231Sotto ((N) <= SIZE_MAX / (ELSIZE) ? (size_t) (N) * (ELSIZE) : SIZE_MAX)
100*2ddaa231Sotto
101*2ddaa231Sotto /* Check for overflow. */
102*2ddaa231Sotto #define size_overflow_p(SIZE) \
103*2ddaa231Sotto ((SIZE) == SIZE_MAX)
104*2ddaa231Sotto /* Check against overflow. */
105*2ddaa231Sotto #define size_in_bounds_p(SIZE) \
106*2ddaa231Sotto ((SIZE) != SIZE_MAX)
107*2ddaa231Sotto
108*2ddaa231Sotto #endif /* _XSIZE_H */
109