1/*
2 * Copyright 2017 Google Inc.
3 *
4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file.
6 */
7
8#ifndef SkSafeMath_DEFINED
9#define SkSafeMath_DEFINED
10
11#include "include/core/SkTypes.h"
12#include "include/private/SkTFitsIn.h"
13#include <limits>
14
15// SkSafeMath always check that a series of operations do not overflow.
16// This must be correct for all platforms, because this is a check for safety at runtime.
17
18class SkSafeMath {
19public:
20 SkSafeMath() = default;
21
22 bool ok() const { return fOK; }
23 explicit operator bool() const { return fOK; }
24
25 size_t mul(size_t x, size_t y) {
26 return sizeof(size_t) == sizeof(uint64_t) ? mul64(x, y) : mul32(x, y);
27 }
28
29 size_t add(size_t x, size_t y) {
30 size_t result = x + y;
31 fOK &= result >= x;
32 return result;
33 }
34
35 /**
36 * Return a + b, unless this result is an overflow/underflow. In those cases, fOK will
37 * be set to false, and it is undefined what this returns.
38 */
39 int addInt(int a, int b) {
40 if (b < 0 && a < std::numeric_limits<int>::min() - b) {
41 fOK = false;
42 return a;
43 } else if (b > 0 && a > std::numeric_limits<int>::max() - b) {
44 fOK = false;
45 return a;
46 }
47 return a + b;
48 }
49
50 size_t alignUp(size_t x, size_t alignment) {
51 SkASSERT(alignment && !(alignment & (alignment - 1)));
52 return add(x, alignment - 1) & ~(alignment - 1);
53 }
54
55 template <typename T> T castTo(size_t value) {
56 if (!SkTFitsIn<T>(value)) {
57 fOK = false;
58 }
59 return static_cast<T>(value);
60 }
61
62 // These saturate to their results
63 static size_t Add(size_t x, size_t y);
64 static size_t Mul(size_t x, size_t y);
65 static size_t Align4(size_t x) {
66 SkSafeMath safe;
67 return safe.alignUp(x, 4);
68 }
69
70private:
71 uint32_t mul32(uint32_t x, uint32_t y) {
72 uint64_t bx = x;
73 uint64_t by = y;
74 uint64_t result = bx * by;
75 fOK &= result >> 32 == 0;
76 return result;
77 }
78
79 uint64_t mul64(uint64_t x, uint64_t y) {
80 if (x <= std::numeric_limits<uint64_t>::max() >> 32
81 && y <= std::numeric_limits<uint64_t>::max() >> 32) {
82 return x * y;
83 } else {
84 auto hi = [](uint64_t x) { return x >> 32; };
85 auto lo = [](uint64_t x) { return x & 0xFFFFFFFF; };
86
87 uint64_t lx_ly = lo(x) * lo(y);
88 uint64_t hx_ly = hi(x) * lo(y);
89 uint64_t lx_hy = lo(x) * hi(y);
90 uint64_t hx_hy = hi(x) * hi(y);
91 uint64_t result = 0;
92 result = this->add(lx_ly, (hx_ly << 32));
93 result = this->add(result, (lx_hy << 32));
94 fOK &= (hx_hy + (hx_ly >> 32) + (lx_hy >> 32)) == 0;
95
96 #if defined(SK_DEBUG) && defined(__clang__) && defined(__x86_64__)
97 auto double_check = (unsigned __int128)x * y;
98 SkASSERT(result == (double_check & 0xFFFFFFFFFFFFFFFF));
99 SkASSERT(!fOK || (double_check >> 64 == 0));
100 #endif
101
102 return result;
103 }
104 }
105 bool fOK = true;
106};
107
108#endif//SkSafeMath_DEFINED
109