| // Copyright 2014 The Chromium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #ifndef PDFIUM_THIRD_PARTY_BASE_SAFE_MATH_H_ |
| #define PDFIUM_THIRD_PARTY_BASE_SAFE_MATH_H_ |
| |
| #include "safe_math_impl.h" |
| |
| namespace pdfium { |
| namespace base { |
| namespace internal { |
| |
| // CheckedNumeric implements all the logic and operators for detecting integer |
| // boundary conditions such as overflow, underflow, and invalid conversions. |
| // The CheckedNumeric type implicitly converts from floating point and integer |
| // data types, and contains overloads for basic arithmetic operations (i.e.: +, |
| // -, *, /, %). |
| // |
| // The following methods convert from CheckedNumeric to standard numeric values: |
| // IsValid() - Returns true if the underlying numeric value is valid (i.e. has |
| // has not wrapped and is not the result of an invalid conversion). |
| // ValueOrDie() - Returns the underlying value. If the state is not valid this |
| // call will crash on a CHECK. |
| // ValueOrDefault() - Returns the current value, or the supplied default if the |
| // state is not valid. |
| // ValueFloating() - Returns the underlying floating point value (valid only |
| // only for floating point CheckedNumeric types). |
| // |
| // Bitwise operations are explicitly not supported, because correct |
| // handling of some cases (e.g. sign manipulation) is ambiguous. Comparison |
| // operations are explicitly not supported because they could result in a crash |
| // on a CHECK condition. You should use patterns like the following for these |
| // operations: |
| // Bitwise operation: |
| // CheckedNumeric<int> checked_int = untrusted_input_value; |
| // int x = checked_int.ValueOrDefault(0) | kFlagValues; |
| // Comparison: |
| // CheckedNumeric<size_t> checked_size; |
| // CheckedNumeric<int> checked_size = untrusted_input_value; |
| // checked_size = checked_size + HEADER LENGTH; |
| // if (checked_size.IsValid() && checked_size.ValueOrDie() < buffer_size) |
| // Do stuff... |
| template <typename T> |
| class CheckedNumeric { |
| public: |
| typedef T type; |
| |
| CheckedNumeric() {} |
| |
| // Copy constructor. |
| template <typename Src> |
| CheckedNumeric(const CheckedNumeric<Src>& rhs) |
| : state_(rhs.ValueUnsafe(), rhs.validity()) {} |
| |
| template <typename Src> |
| CheckedNumeric(Src value, RangeConstraint validity) |
| : state_(value, validity) {} |
| |
| // This is not an explicit constructor because we implicitly upgrade regular |
| // numerics to CheckedNumerics to make them easier to use. |
| template <typename Src> |
| CheckedNumeric(Src value) |
| : state_(value) { |
| COMPILE_ASSERT(std::numeric_limits<Src>::is_specialized, |
| argument_must_be_numeric); |
| } |
| |
| // IsValid() is the public API to test if a CheckedNumeric is currently valid. |
| bool IsValid() const { return validity() == RANGE_VALID; } |
| |
| // ValueOrDie() The primary accessor for the underlying value. If the current |
| // state is not valid it will CHECK and crash. |
| T ValueOrDie() const { |
| CHECK(IsValid()); |
| return state_.value(); |
| } |
| |
| // ValueOrDefault(T default_value) A convenience method that returns the |
| // current value if the state is valid, and the supplied default_value for |
| // any other state. |
| T ValueOrDefault(T default_value) const { |
| return IsValid() ? state_.value() : default_value; |
| } |
| |
| // ValueFloating() - Since floating point values include their validity state, |
| // we provide an easy method for extracting them directly, without a risk of |
| // crashing on a CHECK. |
| T ValueFloating() const { |
| COMPILE_ASSERT(std::numeric_limits<T>::is_iec559, argument_must_be_float); |
| return CheckedNumeric<T>::cast(*this).ValueUnsafe(); |
| } |
| |
| // validity() - DO NOT USE THIS IN EXTERNAL CODE - It is public right now for |
| // tests and to avoid a big matrix of friend operator overloads. But the |
| // values it returns are likely to change in the future. |
| // Returns: current validity state (i.e. valid, overflow, underflow, nan). |
| // TODO(jschuh): crbug.com/332611 Figure out and implement semantics for |
| // saturation/wrapping so we can expose this state consistently and implement |
| // saturated arithmetic. |
| RangeConstraint validity() const { return state_.validity(); } |
| |
| // ValueUnsafe() - DO NOT USE THIS IN EXTERNAL CODE - It is public right now |
| // for tests and to avoid a big matrix of friend operator overloads. But the |
| // values it returns are likely to change in the future. |
| // Returns: the raw numeric value, regardless of the current state. |
| // TODO(jschuh): crbug.com/332611 Figure out and implement semantics for |
| // saturation/wrapping so we can expose this state consistently and implement |
| // saturated arithmetic. |
| T ValueUnsafe() const { return state_.value(); } |
| |
| // Prototypes for the supported arithmetic operator overloads. |
| template <typename Src> CheckedNumeric& operator+=(Src rhs); |
| template <typename Src> CheckedNumeric& operator-=(Src rhs); |
| template <typename Src> CheckedNumeric& operator*=(Src rhs); |
| template <typename Src> CheckedNumeric& operator/=(Src rhs); |
| template <typename Src> CheckedNumeric& operator%=(Src rhs); |
| |
| CheckedNumeric operator-() const { |
| RangeConstraint validity; |
| T value = CheckedNeg(state_.value(), &validity); |
| // Negation is always valid for floating point. |
| if (std::numeric_limits<T>::is_iec559) |
| return CheckedNumeric<T>(value); |
| |
| validity = GetRangeConstraint(state_.validity() | validity); |
| return CheckedNumeric<T>(value, validity); |
| } |
| |
| CheckedNumeric Abs() const { |
| RangeConstraint validity; |
| T value = CheckedAbs(state_.value(), &validity); |
| // Absolute value is always valid for floating point. |
| if (std::numeric_limits<T>::is_iec559) |
| return CheckedNumeric<T>(value); |
| |
| validity = GetRangeConstraint(state_.validity() | validity); |
| return CheckedNumeric<T>(value, validity); |
| } |
| |
| CheckedNumeric& operator++() { |
| *this += 1; |
| return *this; |
| } |
| |
| CheckedNumeric operator++(int) { |
| CheckedNumeric value = *this; |
| *this += 1; |
| return value; |
| } |
| |
| CheckedNumeric& operator--() { |
| *this -= 1; |
| return *this; |
| } |
| |
| CheckedNumeric operator--(int) { |
| CheckedNumeric value = *this; |
| *this -= 1; |
| return value; |
| } |
| |
| // These static methods behave like a convenience cast operator targeting |
| // the desired CheckedNumeric type. As an optimization, a reference is |
| // returned when Src is the same type as T. |
| template <typename Src> |
| static CheckedNumeric<T> cast( |
| Src u, |
| typename std::enable_if<std::numeric_limits<Src>::is_specialized, |
| int>::type = 0) { |
| return u; |
| } |
| |
| template <typename Src> |
| static CheckedNumeric<T> cast( |
| const CheckedNumeric<Src>& u, |
| typename std::enable_if<!std::is_same<Src, T>::value, int>::type = 0) { |
| return u; |
| } |
| |
| static const CheckedNumeric<T>& cast(const CheckedNumeric<T>& u) { return u; } |
| |
| private: |
| CheckedNumericState<T> state_; |
| }; |
| |
| // This is the boilerplate for the standard arithmetic operator overloads. A |
| // macro isn't the prettiest solution, but it beats rewriting these five times. |
| // Some details worth noting are: |
| // * We apply the standard arithmetic promotions. |
| // * We skip range checks for floating points. |
| // * We skip range checks for destination integers with sufficient range. |
| // TODO(jschuh): extract these out into templates. |
| #define BASE_NUMERIC_ARITHMETIC_OPERATORS(NAME, OP, COMPOUND_OP) \ |
| /* Binary arithmetic operator for CheckedNumerics of the same type. */ \ |
| template <typename T> \ |
| CheckedNumeric<typename ArithmeticPromotion<T>::type> operator OP( \ |
| const CheckedNumeric<T>& lhs, const CheckedNumeric<T>& rhs) { \ |
| typedef typename ArithmeticPromotion<T>::type Promotion; \ |
| /* Floating point always takes the fast path */ \ |
| if (std::numeric_limits<T>::is_iec559) \ |
| return CheckedNumeric<T>(lhs.ValueUnsafe() OP rhs.ValueUnsafe()); \ |
| if (IsIntegerArithmeticSafe<Promotion, T, T>::value) \ |
| return CheckedNumeric<Promotion>( \ |
| lhs.ValueUnsafe() OP rhs.ValueUnsafe(), \ |
| GetRangeConstraint(rhs.validity() | lhs.validity())); \ |
| RangeConstraint validity = RANGE_VALID; \ |
| T result = Checked##NAME(static_cast<Promotion>(lhs.ValueUnsafe()), \ |
| static_cast<Promotion>(rhs.ValueUnsafe()), \ |
| &validity); \ |
| return CheckedNumeric<Promotion>( \ |
| result, \ |
| GetRangeConstraint(validity | lhs.validity() | rhs.validity())); \ |
| } \ |
| /* Assignment arithmetic operator implementation from CheckedNumeric. */ \ |
| template <typename T> \ |
| template <typename Src> \ |
| CheckedNumeric<T>& CheckedNumeric<T>::operator COMPOUND_OP(Src rhs) { \ |
| *this = CheckedNumeric<T>::cast(*this) OP CheckedNumeric<Src>::cast(rhs); \ |
| return *this; \ |
| } \ |
| /* Binary arithmetic operator for CheckedNumeric of different type. */ \ |
| template <typename T, typename Src> \ |
| CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> operator OP( \ |
| const CheckedNumeric<Src>& lhs, const CheckedNumeric<T>& rhs) { \ |
| typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ |
| if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ |
| return CheckedNumeric<Promotion>( \ |
| lhs.ValueUnsafe() OP rhs.ValueUnsafe(), \ |
| GetRangeConstraint(rhs.validity() | lhs.validity())); \ |
| return CheckedNumeric<Promotion>::cast(lhs) \ |
| OP CheckedNumeric<Promotion>::cast(rhs); \ |
| } \ |
| /* Binary arithmetic operator for left CheckedNumeric and right numeric. */ \ |
| template <typename T, typename Src> \ |
| CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> operator OP( \ |
| const CheckedNumeric<T>& lhs, Src rhs) { \ |
| typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ |
| if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ |
| return CheckedNumeric<Promotion>(lhs.ValueUnsafe() OP rhs, \ |
| lhs.validity()); \ |
| return CheckedNumeric<Promotion>::cast(lhs) \ |
| OP CheckedNumeric<Promotion>::cast(rhs); \ |
| } \ |
| /* Binary arithmetic operator for right numeric and left CheckedNumeric. */ \ |
| template <typename T, typename Src> \ |
| CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> operator OP( \ |
| Src lhs, const CheckedNumeric<T>& rhs) { \ |
| typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ |
| if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ |
| return CheckedNumeric<Promotion>(lhs OP rhs.ValueUnsafe(), \ |
| rhs.validity()); \ |
| return CheckedNumeric<Promotion>::cast(lhs) \ |
| OP CheckedNumeric<Promotion>::cast(rhs); \ |
| } |
| |
| BASE_NUMERIC_ARITHMETIC_OPERATORS(Add, +, += ) |
| BASE_NUMERIC_ARITHMETIC_OPERATORS(Sub, -, -= ) |
| BASE_NUMERIC_ARITHMETIC_OPERATORS(Mul, *, *= ) |
| BASE_NUMERIC_ARITHMETIC_OPERATORS(Div, /, /= ) |
| BASE_NUMERIC_ARITHMETIC_OPERATORS(Mod, %, %= ) |
| |
| #undef BASE_NUMERIC_ARITHMETIC_OPERATORS |
| |
| } // namespace internal |
| |
| using internal::CheckedNumeric; |
| |
| } // namespace base |
| } // namespace pdfium |
| |
| #endif // PDFIUM_THIRD_PARTY_BASE_SAFE_MATH_H_ |