1 /* 2 * Copyright 2017 Google Inc. 3 * 4 * Use of this source code is governed by a BSD-style license that can be 5 * found in the LICENSE file. 6 */ 7 8 #ifndef SkSafeMath_DEFINED 9 #define SkSafeMath_DEFINED 10 11 #include "SkTFitsIn.h" 12 #include "SkTypes.h" 13 #include <limits> 14 15 // SkSafeMath always check that a series of operations do not overflow. 16 // This must be correct for all platforms, because this is a check for safety at runtime. 17 18 class SkSafeMath { 19 public: 20 SkSafeMath() = default; 21 ok()22 bool ok() const { return fOK; } 23 explicit operator bool() const { return fOK; } 24 mul(size_t x,size_t y)25 size_t mul(size_t x, size_t y) { 26 return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y); 27 } 28 add(size_t x,size_t y)29 size_t add(size_t x, size_t y) { 30 size_t result = x + y; 31 fOK &= result >= x; 32 return result; 33 } 34 35 /** 36 * Return a + b, unless this result is an overflow/underflow. In those cases, fOK will 37 * be set to false, and it is undefined what this returns. 38 */ addInt(int a,int b)39 int addInt(int a, int b) { 40 if (b < 0 && a < std::numeric_limits<int>::min() - b) { 41 fOK = false; 42 return a; 43 } else if (b > 0 && a > std::numeric_limits<int>::max() - b) { 44 fOK = false; 45 return a; 46 } 47 return a + b; 48 } 49 alignUp(size_t x,size_t alignment)50 size_t alignUp(size_t x, size_t alignment) { 51 SkASSERT(alignment && !(alignment & (alignment - 1))); 52 return add(x, alignment - 1) & ~(alignment - 1); 53 } 54 castTo(size_t value)55 template <typename T> T castTo(size_t value) { 56 if (!SkTFitsIn<T>(value)) { 57 fOK = false; 58 } 59 return static_cast<T>(value); 60 } 61 62 // These saturate to their results 63 static size_t Add(size_t x, size_t y); 64 static size_t Mul(size_t x, size_t y); Align4(size_t x)65 static size_t Align4(size_t x) { 66 SkSafeMath safe; 67 return safe.alignUp(x, 4); 68 } 69 70 private: mul32(uint32_t x,uint32_t y)71 uint32_t mul32(uint32_t x, uint32_t y) { 72 uint64_t bx = x; 73 uint64_t by = y; 74 uint64_t result = bx * by; 75 fOK &= result >> 32 == 0; 76 return result; 77 } 78 mul64(uint64_t x,uint64_t y)79 uint64_t mul64(uint64_t x, uint64_t y) { 80 if (x <= std::numeric_limits<uint64_t>::max() >> 32 81 && y <= std::numeric_limits<uint64_t>::max() >> 32) { 82 return x * y; 83 } else { 84 auto hi = [](uint64_t x) { return x >> 32; }; 85 auto lo = [](uint64_t x) { return x & 0xFFFFFFFF; }; 86 87 uint64_t lx_ly = lo(x) * lo(y); 88 uint64_t hx_ly = hi(x) * lo(y); 89 uint64_t lx_hy = lo(x) * hi(y); 90 uint64_t hx_hy = hi(x) * hi(y); 91 uint64_t result = 0; 92 result = this->add(lx_ly, (hx_ly << 32)); 93 result = this->add(result, (lx_hy << 32)); 94 fOK &= (hx_hy + (hx_ly >> 32) + (lx_hy >> 32)) == 0; 95 96 #if defined(SK_DEBUG) && defined(__clang__) && defined(__x86_64__) 97 auto double_check = (unsigned __int128)x * y; 98 SkASSERT(result == (double_check & 0xFFFFFFFFFFFFFFFF)); 99 SkASSERT(!fOK || (double_check >> 64 == 0)); 100 #endif 101 102 return result; 103 } 104 } 105 bool fOK = true; 106 }; 107 108 #endif//SkSafeMath_DEFINED 109