SkSafeMath.h 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108
  1. /*
  2. * Copyright 2017 Google Inc.
  3. *
  4. * Use of this source code is governed by a BSD-style license that can be
  5. * found in the LICENSE file.
  6. */
  7. #ifndef SkSafeMath_DEFINED
  8. #define SkSafeMath_DEFINED
  9. #include "include/core/SkTypes.h"
  10. #include "include/private/SkTFitsIn.h"
  11. #include <limits>
  12. // SkSafeMath always check that a series of operations do not overflow.
  13. // This must be correct for all platforms, because this is a check for safety at runtime.
  14. class SkSafeMath {
  15. public:
  16. SkSafeMath() = default;
  17. bool ok() const { return fOK; }
  18. explicit operator bool() const { return fOK; }
  19. size_t mul(size_t x, size_t y) {
  20. return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y);
  21. }
  22. size_t add(size_t x, size_t y) {
  23. size_t result = x + y;
  24. fOK &= result >= x;
  25. return result;
  26. }
  27. /**
  28. * Return a + b, unless this result is an overflow/underflow. In those cases, fOK will
  29. * be set to false, and it is undefined what this returns.
  30. */
  31. int addInt(int a, int b) {
  32. if (b < 0 && a < std::numeric_limits<int>::min() - b) {
  33. fOK = false;
  34. return a;
  35. } else if (b > 0 && a > std::numeric_limits<int>::max() - b) {
  36. fOK = false;
  37. return a;
  38. }
  39. return a + b;
  40. }
  41. size_t alignUp(size_t x, size_t alignment) {
  42. SkASSERT(alignment && !(alignment & (alignment - 1)));
  43. return add(x, alignment - 1) & ~(alignment - 1);
  44. }
  45. template <typename T> T castTo(size_t value) {
  46. if (!SkTFitsIn<T>(value)) {
  47. fOK = false;
  48. }
  49. return static_cast<T>(value);
  50. }
  51. // These saturate to their results
  52. static size_t Add(size_t x, size_t y);
  53. static size_t Mul(size_t x, size_t y);
  54. static size_t Align4(size_t x) {
  55. SkSafeMath safe;
  56. return safe.alignUp(x, 4);
  57. }
  58. private:
  59. uint32_t mul32(uint32_t x, uint32_t y) {
  60. uint64_t bx = x;
  61. uint64_t by = y;
  62. uint64_t result = bx * by;
  63. fOK &= result >> 32 == 0;
  64. return result;
  65. }
  66. uint64_t mul64(uint64_t x, uint64_t y) {
  67. if (x <= std::numeric_limits<uint64_t>::max() >> 32
  68. && y <= std::numeric_limits<uint64_t>::max() >> 32) {
  69. return x * y;
  70. } else {
  71. auto hi = [](uint64_t x) { return x >> 32; };
  72. auto lo = [](uint64_t x) { return x & 0xFFFFFFFF; };
  73. uint64_t lx_ly = lo(x) * lo(y);
  74. uint64_t hx_ly = hi(x) * lo(y);
  75. uint64_t lx_hy = lo(x) * hi(y);
  76. uint64_t hx_hy = hi(x) * hi(y);
  77. uint64_t result = 0;
  78. result = this->add(lx_ly, (hx_ly << 32));
  79. result = this->add(result, (lx_hy << 32));
  80. fOK &= (hx_hy + (hx_ly >> 32) + (lx_hy >> 32)) == 0;
  81. #if defined(SK_DEBUG) && defined(__clang__) && defined(__x86_64__)
  82. auto double_check = (unsigned __int128)x * y;
  83. SkASSERT(result == (double_check & 0xFFFFFFFFFFFFFFFF));
  84. SkASSERT(!fOK || (double_check >> 64 == 0));
  85. #endif
  86. return result;
  87. }
  88. }
  89. bool fOK = true;
  90. };
  91. #endif//SkSafeMath_DEFINED