Description: Fix integer multiplication overflows Fixes CVE-2019-9036. This patch is a trimmed-down version of the upstream commit, in order to minimize its size while focusing on the important parts. Origin: backport, https://github.com/tbeu/matio/commit/df23944bc8f16dc7270fa39c772e14958aadc283 Bug: https://github.com/tbeu/matio/issues/103 Bug-Debian: https://bugs.debian.org/924185 Last-Update: 2019-03-22 --- This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ --- a/src/Makefile.am +++ b/src/Makefile.am @@ -41,7 +41,7 @@ endif nodist_noinst_HEADERS = matioConfig.h nodist_include_HEADERS = matio_pubconf.h include_HEADERS = matio.h -noinst_HEADERS = matio_private.h mat4.h mat5.h mat73.h +noinst_HEADERS = exact-int.h matio_private.h mat4.h mat5.h mat73.h safe-math.h lib_LTLIBRARIES = libmatio.la libmatio_la_SOURCES = snprintf.c endian.c io.c $(ZLIB_SRC) read_data.c \ mat5.c mat4.c mat.c matvar_cell.c matvar_struct.c --- /dev/null +++ b/src/exact-int.h @@ -0,0 +1,229 @@ +/* Exact-width integer types + * Portable Snippets - https://gitub.com/nemequ/portable-snippets + * Created by Evan Nemerson + * + * To the extent possible under law, the authors have waived all + * copyright and related or neighboring rights to this code. For + * details, see the Creative Commons Zero 1.0 Universal license at + * https://creativecommons.org/publicdomain/zero/1.0/ + * + * This header tries to define psnip_(u)int(8|16|32|64)_t to + * appropriate types given your system. For most systems this means + * including and adding a few preprocessor definitions. + * + * If you prefer, you can define any necessary types yourself. + * Snippets in this repository which rely on these types will not + * attempt to include this header if you have already defined the + * types it uses. + */ + +#if !defined(PSNIP_EXACT_INT_H) +# define PSNIP_EXACT_INT_H +# if !defined(PSNIP_EXACT_INT_HAVE_STDINT) +# if defined(_STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) +# define PSNIP_EXACT_INT_HAVE_STDINT +# elif defined(__has_include) +# if __has_include() +# define PSNIP_EXACT_INT_HAVE_STDINT +# endif +# elif \ + defined(HAVE_STDINT_H) || \ + defined(_STDINT_H_INCLUDED) || \ + defined(_STDINT_H) || \ + defined(_STDINT_H_) +# define PSNIP_EXACT_INT_HAVE_STDINT +# elif \ + (defined(__GNUC__) && ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5))) || \ + (defined(_MSC_VER) && (_MSC_VER >= 1600)) || \ + (defined(__SUNPRO_C) && (__SUNPRO_C >= 0x570)) || \ + (defined(__WATCOMC__) && (__WATCOMC__ >= 1250)) +# define PSNIP_EXACT_INT_HAVE_STDINT +# endif +# endif + +# if \ + defined(__INT8_TYPE__) && defined(__INT16_TYPE__) && defined(__INT32_TYPE__) && defined(__INT64_TYPE__) && \ + defined(__UINT8_TYPE__) && defined(__UINT16_TYPE__) && defined(__UINT32_TYPE__) && defined(__UINT64_TYPE__) +# define psnip_int8_t __INT8_TYPE__ +# define psnip_int16_t __INT16_TYPE__ +# define psnip_int32_t __INT32_TYPE__ +# define psnip_int64_t __INT64_TYPE__ +# define psnip_uint8_t __UINT8_TYPE__ +# define psnip_uint16_t __UINT16_TYPE__ +# define psnip_uint32_t __UINT32_TYPE__ +# define psnip_uint64_t __UINT64_TYPE__ +# elif defined(PSNIP_EXACT_INT_HAVE_STDINT) +# include +# if !defined(psnip_int8_t) +# define psnip_int8_t int8_t +# endif +# if !defined(psnip_uint8_t) +# define psnip_uint8_t uint8_t +# endif +# if !defined(psnip_int16_t) +# define psnip_int16_t int16_t +# endif +# if !defined(psnip_uint16_t) +# define psnip_uint16_t uint16_t +# endif +# if !defined(psnip_int32_t) +# define psnip_int32_t int32_t +# endif +# if !defined(psnip_uint32_t) +# define psnip_uint32_t uint32_t +# endif +# if !defined(psnip_int64_t) +# define psnip_int64_t int64_t +# endif +# if !defined(psnip_uint64_t) +# define psnip_uint64_t uint64_t +# endif +# elif defined(_MSC_VER) +# if !defined(psnip_int8_t) +# define psnip_int8_t __int8 +# endif +# if !defined(psnip_uint8_t) +# define psnip_uint8_t unsigned __int8 +# endif +# if !defined(psnip_int16_t) +# define psnip_int16_t __int16 +# endif +# if !defined(psnip_uint16_t) +# define psnip_uint16_t unsigned __int16 +# endif +# if !defined(psnip_int32_t) +# define psnip_int32_t __int32 +# endif +# if !defined(psnip_uint32_t) +# define psnip_uint32_t unsigned __int32 +# endif +# if !defined(psnip_int64_t) +# define psnip_int64_t __int64 +# endif +# if !defined(psnip_uint64_t) +# define psnip_uint64_t unsigned __int64 +# endif +# else +# include +# if !defined(psnip_int8_t) +# if defined(CHAR_MIN) && defined(CHAR_MAX) && (CHAR_MIN == (-127-1)) && (CHAR_MAX == 127) +# define psnip_int8_t char +# elif defined(SHRT_MIN) && defined(SHRT_MAX) && (SHRT_MIN == (-127-1)) && (SHRT_MAX == 127) +# define psnip_int8_t short +# elif defined(INT_MIN) && defined(INT_MAX) && (INT_MIN == (-127-1)) && (INT_MAX == 127) +# define psnip_int8_t int +# elif defined(LONG_MIN) && defined(LONG_MAX) && (LONG_MIN == (-127-1)) && (LONG_MAX == 127) +# define psnip_int8_t long +# elif defined(LLONG_MIN) && defined(LLONG_MAX) && (LLONG_MIN == (-127-1)) && (LLONG_MAX == 127) +# define psnip_int8_t long long +# else +# error Unable to locate 8-bit signed integer type. +# endif +# endif +# if !defined(psnip_uint8_t) +# if defined(UCHAR_MAX) && (UCHAR_MAX == 255) +# define psnip_uint8_t unsigned char +# elif defined(USHRT_MAX) && (USHRT_MAX == 255) +# define psnip_uint8_t unsigned short +# elif defined(UINT_MAX) && (UINT_MAX == 255) +# define psnip_uint8_t unsigned int +# elif defined(ULONG_MAX) && (ULONG_MAX == 255) +# define psnip_uint8_t unsigned long +# elif defined(ULLONG_MAX) && (ULLONG_MAX == 255) +# define psnip_uint8_t unsigned long long +# else +# error Unable to locate 8-bit unsigned integer type. +# endif +# endif +# if !defined(psnip_int16_t) +# if defined(CHAR_MIN) && defined(CHAR_MAX) && (CHAR_MIN == (-32767-1)) && (CHAR_MAX == 32767) +# define psnip_int16_t char +# elif defined(SHRT_MIN) && defined(SHRT_MAX) && (SHRT_MIN == (-32767-1)) && (SHRT_MAX == 32767) +# define psnip_int16_t short +# elif defined(INT_MIN) && defined(INT_MAX) && (INT_MIN == (-32767-1)) && (INT_MAX == 32767) +# define psnip_int16_t int +# elif defined(LONG_MIN) && defined(LONG_MAX) && (LONG_MIN == (-32767-1)) && (LONG_MAX == 32767) +# define psnip_int16_t long +# elif defined(LLONG_MIN) && defined(LLONG_MAX) && (LLONG_MIN == (-32767-1)) && (LLONG_MAX == 32767) +# define psnip_int16_t long long +# else +# error Unable to locate 16-bit signed integer type. +# endif +# endif +# if !defined(psnip_uint16_t) +# if defined(UCHAR_MAX) && (UCHAR_MAX == 65535) +# define psnip_uint16_t unsigned char +# elif defined(USHRT_MAX) && (USHRT_MAX == 65535) +# define psnip_uint16_t unsigned short +# elif defined(UINT_MAX) && (UINT_MAX == 65535) +# define psnip_uint16_t unsigned int +# elif defined(ULONG_MAX) && (ULONG_MAX == 65535) +# define psnip_uint16_t unsigned long +# elif defined(ULLONG_MAX) && (ULLONG_MAX == 65535) +# define psnip_uint16_t unsigned long long +# else +# error Unable to locate 16-bit unsigned integer type. +# endif +# endif +# if !defined(psnip_int32_t) +# if defined(CHAR_MIN) && defined(CHAR_MAX) && (CHAR_MIN == (-2147483647-1)) && (CHAR_MAX == 2147483647) +# define psnip_int32_t char +# elif defined(SHRT_MIN) && defined(SHRT_MAX) && (SHRT_MIN == (-2147483647-1)) && (SHRT_MAX == 2147483647) +# define psnip_int32_t short +# elif defined(INT_MIN) && defined(INT_MAX) && (INT_MIN == (-2147483647-1)) && (INT_MAX == 2147483647) +# define psnip_int32_t int +# elif defined(LONG_MIN) && defined(LONG_MAX) && (LONG_MIN == (-2147483647-1)) && (LONG_MAX == 2147483647) +# define psnip_int32_t long +# elif defined(LLONG_MIN) && defined(LLONG_MAX) && (LLONG_MIN == (-2147483647-1)) && (LLONG_MAX == 2147483647) +# define psnip_int32_t long long +# else +# error Unable to locate 32-bit signed integer type. +# endif +# endif +# if !defined(psnip_uint32_t) +# if defined(UCHAR_MAX) && (UCHAR_MAX == 4294967295) +# define psnip_uint32_t unsigned char +# elif defined(USHRT_MAX) && (USHRT_MAX == 4294967295) +# define psnip_uint32_t unsigned short +# elif defined(UINT_MAX) && (UINT_MAX == 4294967295) +# define psnip_uint32_t unsigned int +# elif defined(ULONG_MAX) && (ULONG_MAX == 4294967295) +# define psnip_uint32_t unsigned long +# elif defined(ULLONG_MAX) && (ULLONG_MAX == 4294967295) +# define psnip_uint32_t unsigned long long +# else +# error Unable to locate 32-bit unsigned integer type. +# endif +# endif +# if !defined(psnip_int64_t) +# if defined(CHAR_MIN) && defined(CHAR_MAX) && (CHAR_MIN == (-9223372036854775807LL-1)) && (CHAR_MAX == 9223372036854775807LL) +# define psnip_int64_t char +# elif defined(SHRT_MIN) && defined(SHRT_MAX) && (SHRT_MIN == (-9223372036854775807LL-1)) && (SHRT_MAX == 9223372036854775807LL) +# define psnip_int64_t short +# elif defined(INT_MIN) && defined(INT_MAX) && (INT_MIN == (-9223372036854775807LL-1)) && (INT_MAX == 9223372036854775807LL) +# define psnip_int64_t int +# elif defined(LONG_MIN) && defined(LONG_MAX) && (LONG_MIN == (-9223372036854775807LL-1)) && (LONG_MAX == 9223372036854775807LL) +# define psnip_int64_t long +# elif defined(LLONG_MIN) && defined(LLONG_MAX) && (LLONG_MIN == (-9223372036854775807LL-1)) && (LLONG_MAX == 9223372036854775807LL) +# define psnip_int64_t long long +# else +# error Unable to locate 64-bit signed integer type. +# endif +# endif +# if !defined(psnip_uint64_t) +# if defined(UCHAR_MAX) && (UCHAR_MAX == 18446744073709551615ULL) +# define psnip_uint64_t unsigned char +# elif defined(USHRT_MAX) && (USHRT_MAX == 18446744073709551615ULL) +# define psnip_uint64_t unsigned short +# elif defined(UINT_MAX) && (UINT_MAX == 18446744073709551615ULL) +# define psnip_uint64_t unsigned int +# elif defined(ULONG_MAX) && (ULONG_MAX == 18446744073709551615ULL) +# define psnip_uint64_t unsigned long +# elif defined(ULLONG_MAX) && (ULLONG_MAX == 18446744073709551615ULL) +# define psnip_uint64_t unsigned long long +# else +# error Unable to locate 64-bit unsigned integer type. +# endif +# endif +# endif +#endif --- a/src/mat.c +++ b/src/mat.c @@ -31,6 +31,7 @@ */ /* FIXME: Implement Unicode support */ +#include "safe-math.h" #include #include #include @@ -159,6 +160,46 @@ ComplexMalloc(size_t nbytes) return complex_data; } +/** @brief Gets number of elements from a variable + * + * Gets number of elements from a variable by overflow-safe + * multiplication + * @ingroup MAT + * @param matvar MAT variable information + * @param nelems Number of elements + * @retval 0 on success + */ +int SafeMulDims(const matvar_t *matvar, size_t* nelems) +{ + int i; + + for ( i = 0; i < matvar->rank; i++ ) { + if ( !psnip_safe_size_mul(nelems, *nelems, matvar->dims[i]) ) { + *nelems = 0; + return 1; + } + } + + return 0; +} + +/** @brief Multiplies two unsigned integers + * + * @param res Result + * @param a First operand + * @param b Second operand + * @retval 0 on success + */ +int SafeMul(size_t* res, size_t a, size_t b) +{ + if ( !psnip_safe_size_mul(res, a, b) ) { + *res = 0; + return 1; + } + + return 0; +} + /* *=================================================================== * Public Functions @@ -718,7 +759,7 @@ Mat_VarCreate(const char *name,enum mati (char**)calloc(nfields,sizeof(*matvar->internal->fieldnames)); for ( i = 0; i < nfields; i++ ) matvar->internal->fieldnames[i] = strdup(fields[i]->name); - nmemb *= nfields; + SafeMul(&nmemb, nmemb, nfields); } } break; @@ -733,7 +774,7 @@ Mat_VarCreate(const char *name,enum mati matvar->nbytes = matvar->data_size; } else { matvar->data_size = data_size; - matvar->nbytes = nmemb*matvar->data_size; + SafeMul(&matvar->nbytes, nmemb, matvar->data_size); } if ( data == NULL ) { if ( MAT_C_CELL == matvar->class_type && nmemb > 0 ) @@ -1165,8 +1206,7 @@ Mat_VarFree(matvar_t *matvar) return; if ( matvar->dims ) { nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + SafeMulDims(matvar, &nmemb); free(matvar->dims); } if ( matvar->data != NULL) { @@ -1174,8 +1214,9 @@ Mat_VarFree(matvar_t *matvar) case MAT_C_STRUCT: if ( !matvar->mem_conserve ) { matvar_t **fields = (matvar_t**)matvar->data; - int nfields = matvar->internal->num_fields; - for ( i = 0; i < nmemb*nfields; i++ ) + size_t nmemb_x_nfields, i; + SafeMul(&nmemb_x_nfields, nmemb, matvar->internal->num_fields); + for ( i = 0; i < nmemb_x_nfields; i++) Mat_VarFree(fields[i]); free(matvar->data); @@ -1499,7 +1540,7 @@ size_t Mat_VarGetSize(matvar_t *matvar) { int i; - size_t bytes = 0; + size_t bytes = 0, ptr = 0; size_t overhead = 0; if ( SIZEOF_VOID_P == 8 ) { @@ -1511,20 +1552,21 @@ Mat_VarGetSize(matvar_t *matvar) } if ( matvar->class_type == MAT_C_STRUCT ) { - int nfields = matvar->internal->num_fields; - int nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; - if ( nmemb*nfields > 0 ) { - matvar_t **fields = (matvar_t**)matvar->data; - if ( NULL != fields ) { - bytes = nmemb*nfields*overhead; - for ( i = 0; i < nmemb*nfields; i++ ) - if ( NULL != fields[i] ) + matvar_t **fields = (matvar_t**)matvar->data; + if ( NULL != fields ) { + size_t nmemb_x_nfields = matvar->internal->num_fields; + SafeMulDims(matvar, &nmemb_x_nfields); + SafeMul(&bytes, nmemb_x_nfields, overhead); + for ( i = 0; i < nmemb_x_nfields; i++ ) { + if ( NULL != fields[i] ) { + if ( MAT_C_EMPTY != fields[i]->class_type ) bytes += Mat_VarGetSize(fields[i]); + else + bytes += ptr - overhead; } } - bytes += 64 /* max field name length */ *nfields; + } + bytes += 64 /* max field name length */ *matvar->internal->num_fields; } else if ( matvar->class_type == MAT_C_CELL ) { matvar_t **cells = (matvar_t**)matvar->data; if ( NULL != cells ) { @@ -1551,15 +1593,14 @@ Mat_VarGetSize(matvar_t *matvar) bytes += matvar->isLogical ? 1 : 8; } } else { - int nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; - bytes = nmemb*Mat_SizeOfClass(matvar->class_type); + if ( matvar->rank > 0 ) { + bytes = Mat_SizeOfClass(matvar->class_type); + SafeMulDims(matvar, &bytes); if ( matvar->isComplex ) bytes *= 2; } return bytes; -} +} } /** @brief Prints the variable information * @@ -1598,11 +1639,11 @@ Mat_VarPrint( matvar_t *matvar, int prin printf(" Rank: %d\n", matvar->rank); if ( matvar->rank == 0 ) return; + nmemb = 1; + SafeMulDims(matvar, &nmemb); printf("Dimensions: %" SIZE_T_FMTSTR,matvar->dims[0]); - nmemb = matvar->dims[0]; for ( i = 1; i < matvar->rank; i++ ) { printf(" x %" SIZE_T_FMTSTR,matvar->dims[i]); - nmemb *= matvar->dims[i]; } printf("\n"); printf("Class Type: %s",class_type_desc[matvar->class_type]); @@ -1617,9 +1658,11 @@ Mat_VarPrint( matvar_t *matvar, int prin if ( MAT_C_STRUCT == matvar->class_type ) { matvar_t **fields = (matvar_t **)matvar->data; int nfields = matvar->internal->num_fields; - if ( nmemb*nfields > 0 ) { - printf("Fields[%" SIZE_T_FMTSTR "] {\n", nfields*nmemb); - for ( i = 0; i < nfields*nmemb; i++ ) { + size_t nmemb_x_nfields = 1; + SafeMul(&nmemb_x_nfields, nmemb, nfields); + if ( nmemb_x_nfields > 0 ) { + printf("Fields[%" SIZE_T_FMTSTR "] {\n", nmemb_x_nfields); + for ( i = 0; i < nmemb_x_nfields; i++ ) { if ( NULL == fields[i] ) { printf(" Name: %s\n Rank: %d\n", matvar->internal->fieldnames[i%nfields],0); --- a/src/mat4.c +++ b/src/mat4.c @@ -281,15 +281,15 @@ Mat_VarWrite4(mat_t *mat,matvar_t *matva void Read4(mat_t *mat,matvar_t *matvar) { - unsigned int N; + size_t N = 1; + SafeMulDims(matvar, &N); (void)fseek((FILE*)mat->fp,matvar->internal->datapos,SEEK_SET); - N = matvar->dims[0]*matvar->dims[1]; switch ( matvar->class_type ) { case MAT_C_DOUBLE: matvar->data_size = sizeof(double); - matvar->nbytes = N*matvar->data_size; + SafeMul(&matvar->nbytes, N, matvar->data_size); if ( matvar->isComplex ) { mat_complex_split_t *complex_data = ComplexMalloc(matvar->nbytes); if ( NULL != complex_data ) { @@ -653,7 +653,8 @@ ReadData4(mat_t *mat,matvar_t *matvar,vo err = 1; if ( matvar->isComplex ) { mat_complex_split_t *cdata = (mat_complex_split_t*)data; - long nbytes = edge[0]*edge[1]*Mat_SizeOf(matvar->data_type); + size_t nbytes = Mat_SizeOf(matvar->data_type); + SafeMulDims(matvar, &nbytes); ReadDataSlab2(mat,cdata->Re,class_type,matvar->data_type, matvar->dims,start,stride,edge); @@ -665,12 +666,10 @@ ReadData4(mat_t *mat,matvar_t *matvar,vo matvar->dims,start,stride,edge); } } else if ( matvar->isComplex ) { - int i; mat_complex_split_t *cdata = (mat_complex_split_t*)data; - long nbytes = Mat_SizeOf(matvar->data_type); - for ( i = 0; i < matvar->rank; i++ ) - nbytes *= edge[i]; + size_t nbytes = Mat_SizeOf(matvar->data_type); + SafeMulDims(matvar, &nbytes); ReadDataSlabN(mat,cdata->Re,class_type,matvar->data_type, matvar->rank,matvar->dims,start,stride,edge); @@ -701,16 +700,14 @@ int Mat_VarReadDataLinear4(mat_t *mat,matvar_t *matvar,void *data,int start, int stride,int edge) { - size_t i, nmemb = 1; + size_t nmemb = 1; int err = 0; + err = SafeMulDims(matvar, &nmemb); (void)fseek((FILE*)mat->fp,matvar->internal->datapos,SEEK_SET); matvar->data_size = Mat_SizeOf(matvar->data_type); - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; - if ( stride*(edge-1)+start+1 > nmemb ) { return 1; } @@ -902,9 +899,13 @@ Mat_VarReadNextInfo4(mat_t *mat) Mat_Critical("Couldn't determine file position"); return NULL; } - nBytes = matvar->dims[0]*matvar->dims[1]*Mat_SizeOf(matvar->data_type); - if ( matvar->isComplex ) - nBytes *= 2; + { + size_t tmp2 = Mat_SizeOf(matvar->data_type); + if ( matvar->isComplex ) + tmp2 *= 2; + SafeMulDims(matvar, &tmp2); + nBytes = (long)tmp2; + } (void)fseek((FILE*)mat->fp,nBytes,SEEK_CUR); return matvar; --- a/src/mat5.c +++ b/src/mat5.c @@ -105,7 +105,9 @@ GetStructFieldBufSize(matvar_t *matvar) /* FIXME: Add bytes for the fieldnames */ if ( NULL != fields && nfields > 0 ) { - for ( i = 0; i < nfields*nmemb; i++ ) + size_t nmemb_x_nfields = 1; + SafeMul(&nmemb_x_nfields, nmemb, nfields); + for ( i = 0; i < nmemb_x_nfields; i++ ) nBytes += tag_size + GetStructFieldBufSize(fields[i]); } break; @@ -1767,15 +1769,22 @@ WriteCompressedData(mat_t *mat,z_streamp static size_t ReadNextCell( mat_t *mat, matvar_t *matvar ) { - size_t bytesread = 0; - int ncells, i; + size_t ncells, bytesread = 0; + int err, i; matvar_t **cells = NULL; ncells = 1; - for ( i = 0; i < matvar->rank; i++ ) - ncells *= matvar->dims[i]; + err = SafeMulDims(matvar, &ncells); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + return bytesread; + } matvar->data_size = sizeof(matvar_t *); - matvar->nbytes = ncells*matvar->data_size; + err = SafeMul(&matvar->nbytes, ncells, matvar->data_size); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + return bytesread; + } matvar->data = malloc(matvar->nbytes); if ( NULL == matvar->data ) { Mat_Critical("Couldn't allocate memory for %s->data",matvar->name); @@ -1786,9 +1795,8 @@ ReadNextCell( mat_t *mat, matvar_t *matv if ( matvar->compression ) { #if defined(HAVE_ZLIB) mat_uint32_t uncomp_buf[16] = {0,}; - int nbytes; + int nbytes, i; mat_uint32_t array_flags; - int err; for ( i = 0; i < ncells; i++ ) { cells[i] = Mat_VarCalloc(); @@ -2098,19 +2106,22 @@ static size_t ReadNextStructField( mat_t *mat, matvar_t *matvar ) { mat_uint32_t fieldname_size; - int j; size_t bytesread = 0, nfields, nmemb = 1, i; + int err; matvar_t **fields = NULL; + size_t nmemb_x_nfields; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + err = SafeMulDims(matvar, &nmemb); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + return bytesread; + } if ( matvar->compression ) { #if defined(HAVE_ZLIB) mat_uint32_t uncomp_buf[16] = {0,}; int nbytes, j; mat_uint32_t array_flags; - int err; /* Inflate Field name length */ bytesread += InflateFieldNameLength(mat,matvar,uncomp_buf); @@ -2160,7 +2171,16 @@ ReadNextStructField( mat_t *mat, matvar_ matvar->internal->fieldnames = NULL; } - matvar->nbytes = nmemb*nfields*matvar->data_size; + err = SafeMul(&nmemb_x_nfields, nmemb, nfields); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + return bytesread; + } + err = SafeMul(&matvar->nbytes, nmemb_x_nfields, matvar->data_size); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + return bytesread; + } if ( !matvar->nbytes ) return bytesread; @@ -2352,7 +2372,16 @@ ReadNextStructField( mat_t *mat, matvar_ bytesread+=8-((nfields*fieldname_size) % 8); } - matvar->nbytes = nmemb*nfields*matvar->data_size; + err = SafeMul(&nmemb_x_nfields, nmemb, nfields); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + return bytesread; + } + err = SafeMul(&matvar->nbytes, nmemb_x_nfields, matvar->data_size); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + return bytesread; + } if ( !matvar->nbytes ) return bytesread; @@ -2368,7 +2397,7 @@ ReadNextStructField( mat_t *mat, matvar_ } } - for ( i = 0; i < nmemb*nfields; i++ ) { + for ( i = 0; i < nmemb_x_nfields; i++ ) { fields[i]->internal->fpos = ftell((FILE*)mat->fp); if ( fields[i]->internal->fpos == -1L ) { @@ -2476,17 +2505,15 @@ ReadNextStructField( mat_t *mat, matvar_ static size_t ReadNextFunctionHandle(mat_t *mat, matvar_t *matvar) { - int nfunctions = 1, i; - size_t bytesread = 0; - - for ( i = 0; i < matvar->rank; i++ ) - nfunctions *= matvar->dims[i]; + int i; + size_t nfunctions = 1, bytesread = 0; - matvar->data = malloc(nfunctions*sizeof(matvar_t *)); + SafeMulDims(matvar, &nfunctions); + matvar->data_size = sizeof(matvar_t *); + SafeMul(&matvar->nbytes, nfunctions, matvar->data_size); + matvar->data = malloc(matvar->nbytes); if ( matvar->data != NULL ) { matvar_t **functions = (matvar_t**)matvar->data;; - matvar->data_size = sizeof(matvar_t *); - matvar->nbytes = nfunctions*matvar->data_size; for ( i = 0; i < nfunctions; i++ ) functions[i] = Mat_VarReadNextInfo(mat); } else { @@ -3813,7 +3840,7 @@ Mat_WriteCompressedEmptyVariable5(mat_t void Mat_VarReadNumeric5(mat_t *mat,matvar_t *matvar,void *data,size_t N) { - int nBytes = 0, data_in_tag = 0; + int nBytes = 0, data_in_tag = 0, err; enum matio_types packed_type = MAT_T_UNKNOWN; mat_uint32_t tag[2]; @@ -3977,11 +4004,11 @@ Mat_VarReadNumeric5(mat_t *mat,matvar_t void Read5(mat_t *mat, matvar_t *matvar) { - int nBytes = 0, len = 1, i, byteswap, data_in_tag = 0; + int nBytes = 0, i, byteswap, data_in_tag = 0, err; enum matio_types packed_type = MAT_T_UNKNOWN; long fpos; mat_uint32_t tag[2]; - size_t bytesread = 0; + size_t len = 1, bytesread = 0; if ( matvar == NULL ) return; @@ -4001,9 +4028,12 @@ Read5(mat_t *mat, matvar_t *matvar) return; } len = 1; + err = SafeMulDims(matvar, &len); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + return; + } byteswap = mat->byteswap; - for ( i = 0; i < matvar->rank; i++ ) - len *= matvar->dims[i]; switch ( matvar->class_type ) { case MAT_C_EMPTY: matvar->nbytes = 0; @@ -4260,7 +4290,7 @@ Read5(mat_t *mat, matvar_t *matvar) if ( matvar->isComplex ) { mat_complex_split_t *complex_data; - matvar->nbytes = len*matvar->data_size; + SafeMul(&matvar->nbytes, len, matvar->data_size); complex_data = ComplexMalloc(matvar->nbytes); if ( NULL == complex_data ) { Mat_Critical("Memory allocation failure"); @@ -4270,7 +4300,7 @@ Read5(mat_t *mat, matvar_t *matvar) Mat_VarReadNumeric5(mat,matvar,complex_data->Im,len); matvar->data = complex_data; } else { - matvar->nbytes = len*matvar->data_size; + SafeMul(&matvar->nbytes, len, matvar->data_size); matvar->data = malloc(matvar->nbytes); if ( NULL == matvar->data ) { Mat_Critical("Failed to allocate %d bytes",matvar->nbytes); @@ -4369,14 +4399,14 @@ Read5(mat_t *mat, matvar_t *matvar) case MAT_C_STRUCT: { matvar_t **fields; - int nfields = 0; + size_t len_x_nfields, i; matvar->data_type = MAT_T_STRUCT; if ( !matvar->nbytes || !matvar->data_size || NULL == matvar->data ) break; - nfields = matvar->internal->num_fields; + SafeMul(&len_x_nfields, len, matvar->internal->num_fields); fields = (matvar_t **)matvar->data; - for ( i = 0; i < len*nfields; i++ ) { + for ( i = 0; i < len_x_nfields; i++ ) { if ( NULL != fields[i] ) { fields[i]->internal->fp = mat; Read5(mat,fields[i]); @@ -5692,12 +5722,12 @@ int Mat_VarReadDataLinear5(mat_t *mat,matvar_t *matvar,void *data,int start, int stride,int edge) { - int err = 0, nmemb = 1, i, real_bytes = 0; + int err = 0, i, real_bytes = 0; mat_int32_t tag[2]; #if defined(HAVE_ZLIB) z_stream z; #endif - size_t bytesread = 0; + size_t nmemb = 1, bytesread = 0; if ( mat->version == MAT_FT_MAT4 ) return -1; @@ -5763,8 +5793,10 @@ Mat_VarReadDataLinear5(mat_t *mat,matvar if ( real_bytes % 8 ) real_bytes += (8-(real_bytes % 8)); - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + err = SafeMulDims(matvar, &nmemb); + if ( err ) { + Mat_Critical("Integer multiplication overflow"); + } if ( stride*(edge-1)+start+1 > nmemb ) { err = 1; --- a/src/mat73.c +++ b/src/mat73.c @@ -596,17 +596,17 @@ Mat_H5ReadDatasetInfo(mat_t *mat,matvar_ /* If the dataset is a cell array read the info of the cells */ if ( MAT_C_CELL == matvar->class_type ) { matvar_t **cells; - int i,ncells = 1; + size_t ncells = 1; hobj_ref_t *ref_ids; - for ( i = 0; i < matvar->rank; i++ ) - ncells *= matvar->dims[i]; + SafeMulDims(matvar, &ncells); matvar->data_size = sizeof(matvar_t**); - matvar->nbytes = ncells*matvar->data_size; + SafeMul(&matvar->nbytes, ncells, matvar->data_size); matvar->data = malloc(matvar->nbytes); cells = (matvar_t**)matvar->data; if ( ncells ) { + size_t i; ref_ids = (hobj_ref_t*)malloc(ncells*sizeof(*ref_ids)); H5Dread(dset_id,H5T_STD_REF_OBJ,H5S_ALL,H5S_ALL,H5P_DEFAULT,ref_ids); for ( i = 0; i < ncells; i++ ) { @@ -877,10 +877,14 @@ Mat_H5ReadGroupInfo(mat_t *mat,matvar_t if ( numel < 1 || nfields < 1 ) return; - fields = (matvar_t**)malloc(nfields*numel*sizeof(*fields)); - matvar->data = fields; matvar->data_size = sizeof(*fields); - matvar->nbytes = nfields*numel*matvar->data_size; + { + size_t numel_x_nfields; + SafeMul(&numel_x_nfields, numel, nfields); + SafeMul(&matvar->nbytes, numel_x_nfields, matvar->data_size); + } + fields = (matvar_t**)malloc(matvar->nbytes); + matvar->data = fields; if ( NULL != fields ) { for ( k = 0; k < nfields; k++ ) { int l; @@ -1134,7 +1138,6 @@ Mat_H5ReadNextReferenceInfo(hid_t ref_id static void Mat_H5ReadNextReferenceData(hid_t ref_id,matvar_t *matvar,mat_t *mat) { - int k; size_t numel; hid_t dset_id; @@ -1145,11 +1148,11 @@ Mat_H5ReadNextReferenceData(hid_t ref_id * the variable data, so just loop over each cell element and call * Mat_H5ReadNextReferenceData on it. */ + size_t k; if ( MAT_C_CELL == matvar->class_type ) { matvar_t **cells = (matvar_t**)matvar->data; numel = 1; - for ( k = 0; k < matvar->rank; k++ ) - numel *= matvar->dims[k]; + SafeMulDims(matvar, &numel); for ( k = 0; k < numel; k++ ) Mat_H5ReadNextReferenceData(cells[k]->internal->id,cells[k],mat); return; @@ -1160,8 +1163,7 @@ Mat_H5ReadNextReferenceData(hid_t ref_id { hid_t data_type_id; numel = 1; - for ( k = 0; k < matvar->rank; k++ ) - numel *= matvar->dims[k]; + SafeMulDims(matvar, &numel); if ( MAT_C_CHAR == matvar->class_type ) { matvar->data_type = MAT_T_UINT8; @@ -1174,7 +1176,7 @@ Mat_H5ReadNextReferenceData(hid_t ref_id matvar->data_size = Mat_SizeOfClass(matvar->class_type); data_type_id = Mat_class_type_to_hid_t(matvar->class_type); } - matvar->nbytes = numel*matvar->data_size; + SafeMul(&matvar->nbytes, numel, matvar->data_size); if ( matvar->nbytes < 1 ) { H5Dclose(ref_id); @@ -1923,8 +1925,11 @@ Mat_VarWriteStruct73(hid_t id,matvar_t * hsize_t perm_dims[10]; nmemb = 1; - for ( k = 0; k < matvar->rank; k++ ) - nmemb *= matvar->dims[k]; + { + size_t tmp = 1; + SafeMulDims(matvar, &tmp); + nmemb = (hsize_t)tmp; + } if ( 0 == nmemb || NULL == matvar->data ) { hsize_t rank = matvar->rank; @@ -2238,7 +2243,6 @@ Mat_Create73(const char *matname,const c void Mat_VarRead73(mat_t *mat,matvar_t *matvar) { - int k; size_t numel; hid_t fid,dset_id,ref_id; @@ -2261,10 +2265,9 @@ Mat_VarRead73(mat_t *mat,matvar_t *matva case MAT_C_INT8: case MAT_C_UINT8: numel = 1; - for ( k = 0; k < matvar->rank; k++ ) - numel *= matvar->dims[k]; + SafeMulDims(matvar, &numel); matvar->data_size = Mat_SizeOfClass(matvar->class_type); - matvar->nbytes = numel*matvar->data_size; + SafeMul(&matvar->nbytes, numel, matvar->data_size); if ( numel < 1 ) break; @@ -2316,11 +2319,10 @@ Mat_VarRead73(mat_t *mat,matvar_t *matva break; case MAT_C_CHAR: numel = 1; - for ( k = 0; k < matvar->rank; k++ ) - numel *= matvar->dims[k]; + SafeMulDims(matvar, &numel); matvar->data_type = MAT_T_UINT8; matvar->data_size = 1; - matvar->nbytes = numel*matvar->data_size; + SafeMul(&matvar->nbytes, numel, matvar->data_size); if ( NULL != matvar->internal->hdf5_name ) { dset_id = H5Dopen(fid,matvar->internal->hdf5_name,H5P_DEFAULT); @@ -2340,16 +2342,15 @@ Mat_VarRead73(mat_t *mat,matvar_t *matva case MAT_C_STRUCT: { matvar_t **fields; - int i,nfields = 0; + size_t i, numel_x_nfields; if ( !matvar->internal->num_fields || NULL == matvar->data ) break; numel = 1; - for ( k = 0; k < matvar->rank; k++ ) - numel *= matvar->dims[k]; - nfields = matvar->internal->num_fields; + SafeMulDims(matvar, &numel); + SafeMul(&numel_x_nfields, numel, matvar->internal->num_fields); fields = (matvar_t**)matvar->data; - for ( i = 0; i < nfields*numel; i++ ) { + for ( i = 0; i < numel_x_nfields; i++ ) { if ( 0 < fields[i]->internal->hdf5_ref && -1 < fields[i]->internal->id ) { /* Dataset of references */ --- a/src/matio_private.h +++ b/src/matio_private.h @@ -225,5 +225,7 @@ EXTERN size_t InflateFieldNames(mat_t *m /* mat.c */ EXTERN mat_complex_split_t *ComplexMalloc(size_t nbytes); +EXTERN int SafeMul(size_t* res, size_t a, size_t b); +EXTERN int SafeMulDims(const matvar_t *matvar, size_t* nelems); #endif --- a/src/matvar_cell.c +++ b/src/matvar_cell.c @@ -42,16 +42,15 @@ matvar_t * Mat_VarGetCell(matvar_t *matvar,int index) { - int nmemb = 1, i; + size_t nmemb = 1; matvar_t *cell = NULL; if ( matvar == NULL ) return NULL; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + SafeMulDims(matvar, &nmemb); - if ( index < nmemb ) + if ( 0 <= index && index < nmemb ) cell = *((matvar_t **)matvar->data + index); return cell; @@ -167,17 +166,16 @@ Mat_VarGetCellsLinear(matvar_t *matvar,i matvar_t * Mat_VarSetCell(matvar_t *matvar,int index,matvar_t *cell) { - int nmemb = 1, i; + size_t nmemb = 1; matvar_t **cells, *old_cell = NULL; if ( matvar == NULL || matvar->rank < 1 ) return NULL; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + SafeMulDims(matvar, &nmemb); cells = (matvar_t**)matvar->data; - if ( index < nmemb ) { + if ( 0 <= index && index < nmemb ) { old_cell = cells[index]; cells[index] = cell; } --- a/src/matvar_struct.c +++ b/src/matvar_struct.c @@ -87,12 +87,10 @@ Mat_VarCreateStruct(const char *name,int } } if ( NULL != matvar && nmemb > 0 && nfields > 0 ) { - matvar_t **field_vars; - matvar->nbytes = nmemb*nfields*matvar->data_size; - matvar->data = malloc(matvar->nbytes); - field_vars = (matvar_t**)matvar->data; - for ( i = 0; i < nfields*nmemb; i++ ) - field_vars[i] = NULL; + size_t nmemb_x_nfields; + SafeMul(&nmemb_x_nfields, nmemb, nfields); + SafeMul(&matvar->nbytes, nmemb_x_nfields, matvar->data_size); + matvar->data = calloc(nmemb_x_nfields, matvar->data_size); } } @@ -112,14 +110,14 @@ Mat_VarCreateStruct(const char *name,int int Mat_VarAddStructField(matvar_t *matvar,const char *fieldname) { - int i, f, nfields, nmemb, cnt = 0; + int f, nfields, cnt = 0; matvar_t **new_data, **old_data; + size_t nmemb, i; if ( matvar == NULL || fieldname == NULL ) return -1; nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + SafeMulDims(matvar, &nmemb); nfields = matvar->internal->num_fields+1; matvar->internal->num_fields = nfields; @@ -128,9 +126,16 @@ Mat_VarAddStructField(matvar_t *matvar,c nfields*sizeof(*matvar->internal->fieldnames)); matvar->internal->fieldnames[nfields-1] = strdup(fieldname); - new_data = (matvar_t**)malloc(nfields*nmemb*sizeof(*new_data)); - if ( new_data == NULL ) + { + size_t nmemb_x_nfields; + SafeMul(&nmemb_x_nfields, nmemb, nfields); + SafeMul(&matvar->nbytes, nmemb_x_nfields, sizeof(*new_data)); + } + new_data = (matvar_t**)malloc(matvar->nbytes); + if ( new_data == NULL ) { + matvar->nbytes = 0; return -1; + } old_data = (matvar_t**)matvar->data; for ( i = 0; i < nmemb; i++ ) { @@ -141,7 +146,6 @@ Mat_VarAddStructField(matvar_t *matvar,c free(matvar->data); matvar->data = new_data; - matvar->nbytes = nfields*nmemb*sizeof(*new_data); return 0; } @@ -197,7 +201,7 @@ Mat_VarGetStructFieldnames(const matvar_ matvar_t * Mat_VarGetStructFieldByIndex(matvar_t *matvar,size_t field_index,size_t index) { - int i, nfields; + int nfields; matvar_t *field = NULL; size_t nmemb; @@ -206,9 +210,7 @@ Mat_VarGetStructFieldByIndex(matvar_t *m return field; nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; - + SafeMulDims(matvar, &nmemb); nfields = matvar->internal->num_fields; if ( nmemb > 0 && index >= nmemb ) { @@ -246,8 +248,7 @@ Mat_VarGetStructFieldByName(matvar_t *ma return field; nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + SafeMulDims(matvar, &nmemb); nfields = matvar->internal->num_fields; field_index = -1; @@ -283,12 +284,12 @@ Mat_VarGetStructFieldByName(matvar_t *ma matvar_t * Mat_VarGetStructField(matvar_t *matvar,void *name_or_index,int opt,int index) { - int i, err = 0, nfields, nmemb; + int err = 0, nfields; matvar_t *field = NULL; + size_t nmemb; nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + SafeMulDims(matvar, &nmemb); nfields = matvar->internal->num_fields; @@ -480,7 +481,7 @@ matvar_t * Mat_VarSetStructFieldByIndex(matvar_t *matvar,size_t field_index,size_t index, matvar_t *field) { - int i, nfields; + int nfields; matvar_t *old_field = NULL; size_t nmemb; @@ -489,8 +490,7 @@ Mat_VarSetStructFieldByIndex(matvar_t *m return old_field; nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + SafeMulDims(matvar, &nmemb); nfields = matvar->internal->num_fields; @@ -531,8 +531,7 @@ Mat_VarSetStructFieldByName(matvar_t *ma return old_field; nmemb = 1; - for ( i = 0; i < matvar->rank; i++ ) - nmemb *= matvar->dims[i]; + SafeMulDims(matvar, &nmemb); nfields = matvar->internal->num_fields; field_index = -1; --- /dev/null +++ b/src/safe-math.h @@ -0,0 +1,1045 @@ +/* Overflow-safe math functions + * Portable Snippets - https://gitub.com/nemequ/portable-snippets + * Created by Evan Nemerson + * + * To the extent possible under law, the authors have waived all + * copyright and related or neighboring rights to this code. For + * details, see the Creative Commons Zero 1.0 Universal license at + * https://creativecommons.org/publicdomain/zero/1.0/ + */ + +#if !defined(PSNIP_SAFE_H) +#define PSNIP_SAFE_H + +#if !defined(PSNIP_SAFE_FORCE_PORTABLE) +# if defined(__has_builtin) +# if __has_builtin(__builtin_add_overflow) && !defined(__ibmxl__) +# define PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW +# endif +# elif defined(__GNUC__) && (__GNUC__ >= 5) && !defined(__INTEL_COMPILER) +# define PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW +# endif +# if defined(__has_include) +# if __has_include() +# define PSNIP_SAFE_HAVE_INTSAFE_H +# endif +# elif defined(_WIN32) +# define PSNIP_SAFE_HAVE_INTSAFE_H +# endif +#endif /* !defined(PSNIP_SAFE_FORCE_PORTABLE) */ + +#if defined(__GNUC__) +# define PSNIP_SAFE_LIKELY(expr) __builtin_expect(!!(expr), 1) +# define PSNIP_SAFE_UNLIKELY(expr) __builtin_expect(!!(expr), 0) +#else +# define PSNIP_SAFE_LIKELY(expr) !!(expr) +# define PSNIP_SAFE_UNLIKELY(expr) !!(expr) +#endif /* defined(__GNUC__) */ + +#if !defined(PSNIP_SAFE_STATIC_INLINE) +# if defined(__GNUC__) +# define PSNIP_SAFE__COMPILER_ATTRIBUTES __attribute__((__unused__)) +# else +# define PSNIP_SAFE__COMPILER_ATTRIBUTES +# endif + +# if defined(HEDLEY_INLINE) +# define PSNIP_SAFE__INLINE HEDLEY_INLINE +# elif defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L +# define PSNIP_SAFE__INLINE inline +# elif defined(__GNUC_STDC_INLINE__) +# define PSNIP_SAFE__INLINE __inline__ +# elif defined(_MSC_VER) && _MSC_VER >= 1200 +# define PSNIP_SAFE__INLINE __inline +# else +# define PSNIP_SAFE__INLINE +# endif + +# define PSNIP_SAFE__FUNCTION PSNIP_SAFE__COMPILER_ATTRIBUTES static PSNIP_SAFE__INLINE +#endif + +#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L +# define psnip_safe_bool _Bool +#else +# define psnip_safe_bool int +#endif + +#if !defined(PSNIP_SAFE_NO_FIXED) +# if \ + !defined(psnip_uint8_t) || !defined(psnip_int8_t) || \ + !defined(psnip_uint16_t) || !defined(psnip_int16_t) || \ + !defined(psnip_uint32_t) || !defined(psnip_int32_t) || \ + !defined(psnip_uint64_t) || !defined(psnip_int64_t) +# include "exact-int.h" +#endif +#endif /* !defined(PSNIP_SAFE_NO_FIXED) */ +#include +#include + +#if !defined(PSNIP_SAFE_SIZE_MAX) +# if defined(__SIZE_MAX__) +# define PSNIP_SAFE_SIZE_MAX __SIZE_MAX__ +# elif defined(PSNIP_EXACT_INT_HAVE_STDINT) +# include +# endif +#endif + +#if defined(PSNIP_SAFE_SIZE_MAX) +# define PSNIP_SAFE__SIZE_MAX_RT PSNIP_SAFE_SIZE_MAX +#else +# define PSNIP_SAFE__SIZE_MAX_RT (~((size_t) 0)) +#endif + +#if defined(PSNIP_SAFE_HAVE_INTSAFE_H) +/* In VS 10, stdint.h and intsafe.h both define (U)INTN_MIN/MAX, which + triggers warning C4005 (level 1). */ +# if defined(_MSC_VER) && (_MSC_VER == 1600) +# pragma warning(push) +# pragma warning(disable:4005) +# endif +# include +# if defined(_MSC_VER) && (_MSC_VER == 1600) +# pragma warning(pop) +# endif +#endif /* defined(PSNIP_SAFE_HAVE_INTSAFE_H) */ + +/* If there is a type larger than the one we're concerned with it's + * likely much faster to simply promote the operands, perform the + * requested operation, verify that the result falls within the + * original type, then cast the result back to the original type. */ + +#if !defined(PSNIP_SAFE_NO_PROMOTIONS) + +#define PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, op_name, op) \ + PSNIP_SAFE__FUNCTION psnip_safe_##name##_larger \ + psnip_safe_larger_##name##_##op_name (T a, T b) { \ + return ((psnip_safe_##name##_larger) a) op ((psnip_safe_##name##_larger) b); \ + } + +#define PSNIP_SAFE_DEFINE_LARGER_UNARY_OP(T, name, op_name, op) \ + PSNIP_SAFE__FUNCTION psnip_safe_##name##_larger \ + psnip_safe_larger_##name##_##op_name (T value) { \ + return (op ((psnip_safe_##name##_larger) value)); \ + } + +#define PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(T, name) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, add, +) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, sub, -) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, mul, *) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, div, /) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, mod, %) \ + PSNIP_SAFE_DEFINE_LARGER_UNARY_OP (T, name, neg, -) + +#define PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(T, name) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, add, +) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, sub, -) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, mul, *) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, div, /) \ + PSNIP_SAFE_DEFINE_LARGER_BINARY_OP(T, name, mod, %) + +#define PSNIP_SAFE_IS_LARGER(ORIG_MAX, DEST_MAX) ((DEST_MAX / ORIG_MAX) >= ORIG_MAX) + +#if defined(__GNUC__) && ((__GNUC__ >= 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)) && defined(__SIZEOF_INT128__) && !defined(__ibmxl__) +#define PSNIP_SAFE_HAVE_128 +typedef __int128 psnip_safe_int128_t; +typedef unsigned __int128 psnip_safe_uint128_t; +#endif /* defined(__GNUC__) */ + +#if !defined(PSNIP_SAFE_NO_FIXED) +#define PSNIP_SAFE_HAVE_INT8_LARGER +#define PSNIP_SAFE_HAVE_UINT8_LARGER +typedef psnip_int16_t psnip_safe_int8_larger; +typedef psnip_uint16_t psnip_safe_uint8_larger; + +#define PSNIP_SAFE_HAVE_INT16_LARGER +typedef psnip_int32_t psnip_safe_int16_larger; +typedef psnip_uint32_t psnip_safe_uint16_larger; + +#define PSNIP_SAFE_HAVE_INT32_LARGER +typedef psnip_int64_t psnip_safe_int32_larger; +typedef psnip_uint64_t psnip_safe_uint32_larger; + +#if defined(PSNIP_SAFE_HAVE_128) +#define PSNIP_SAFE_HAVE_INT64_LARGER +typedef psnip_safe_int128_t psnip_safe_int64_larger; +typedef psnip_safe_uint128_t psnip_safe_uint64_larger; +#endif /* defined(PSNIP_SAFE_HAVE_128) */ +#endif /* !defined(PSNIP_SAFE_NO_FIXED) */ + +#define PSNIP_SAFE_HAVE_LARGER_SCHAR +#if PSNIP_SAFE_IS_LARGER(SCHAR_MAX, SHRT_MAX) +typedef short psnip_safe_schar_larger; +#elif PSNIP_SAFE_IS_LARGER(SCHAR_MAX, INT_MAX) +typedef int psnip_safe_schar_larger; +#elif PSNIP_SAFE_IS_LARGER(SCHAR_MAX, LONG_MAX) +typedef long psnip_safe_schar_larger; +#elif PSNIP_SAFE_IS_LARGER(SCHAR_MAX, LLONG_MAX) +typedef long long psnip_safe_schar_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(SCHAR_MAX, 0x7fff) +typedef psnip_int16_t psnip_safe_schar_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(SCHAR_MAX, 0x7fffffffLL) +typedef psnip_int32_t psnip_safe_schar_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(SCHAR_MAX, 0x7fffffffffffffffLL) +typedef psnip_int64_t psnip_safe_schar_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (SCHAR_MAX <= 0x7fffffffffffffffLL) +typedef psnip_safe_int128_t psnip_safe_schar_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_SCHAR +#endif + +#define PSNIP_SAFE_HAVE_LARGER_UCHAR +#if PSNIP_SAFE_IS_LARGER(UCHAR_MAX, USHRT_MAX) +typedef unsigned short psnip_safe_uchar_larger; +#elif PSNIP_SAFE_IS_LARGER(UCHAR_MAX, UINT_MAX) +typedef unsigned int psnip_safe_uchar_larger; +#elif PSNIP_SAFE_IS_LARGER(UCHAR_MAX, ULONG_MAX) +typedef unsigned long psnip_safe_uchar_larger; +#elif PSNIP_SAFE_IS_LARGER(UCHAR_MAX, ULLONG_MAX) +typedef unsigned long long psnip_safe_uchar_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(UCHAR_MAX, 0xffffU) +typedef psnip_uint16_t psnip_safe_uchar_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(UCHAR_MAX, 0xffffffffUL) +typedef psnip_uint32_t psnip_safe_uchar_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(UCHAR_MAX, 0xffffffffffffffffULL) +typedef psnip_uint64_t psnip_safe_uchar_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (UCHAR_MAX <= 0xffffffffffffffffULL) +typedef psnip_safe_uint128_t psnip_safe_uchar_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_UCHAR +#endif + +#if CHAR_MIN == 0 && defined(PSNIP_SAFE_HAVE_LARGER_UCHAR) +#define PSNIP_SAFE_HAVE_LARGER_CHAR +typedef psnip_safe_uchar_larger psnip_safe_char_larger; +#elif CHAR_MIN < 0 && defined(PSNIP_SAFE_HAVE_LARGER_SCHAR) +#define PSNIP_SAFE_HAVE_LARGER_CHAR +typedef psnip_safe_schar_larger psnip_safe_char_larger; +#endif + +#define PSNIP_SAFE_HAVE_LARGER_SHRT +#if PSNIP_SAFE_IS_LARGER(SHRT_MAX, INT_MAX) +typedef int psnip_safe_short_larger; +#elif PSNIP_SAFE_IS_LARGER(SHRT_MAX, LONG_MAX) +typedef long psnip_safe_short_larger; +#elif PSNIP_SAFE_IS_LARGER(SHRT_MAX, LLONG_MAX) +typedef long long psnip_safe_short_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(SHRT_MAX, 0x7fff) +typedef psnip_int16_t psnip_safe_short_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(SHRT_MAX, 0x7fffffffLL) +typedef psnip_int32_t psnip_safe_short_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(SHRT_MAX, 0x7fffffffffffffffLL) +typedef psnip_int64_t psnip_safe_short_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (SHRT_MAX <= 0x7fffffffffffffffLL) +typedef psnip_safe_int128_t psnip_safe_short_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_SHRT +#endif + +#define PSNIP_SAFE_HAVE_LARGER_USHRT +#if PSNIP_SAFE_IS_LARGER(USHRT_MAX, UINT_MAX) +typedef unsigned int psnip_safe_ushort_larger; +#elif PSNIP_SAFE_IS_LARGER(USHRT_MAX, ULONG_MAX) +typedef unsigned long psnip_safe_ushort_larger; +#elif PSNIP_SAFE_IS_LARGER(USHRT_MAX, ULLONG_MAX) +typedef unsigned long long psnip_safe_ushort_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(USHRT_MAX, 0xffff) +typedef psnip_uint16_t psnip_safe_ushort_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(USHRT_MAX, 0xffffffffUL) +typedef psnip_uint32_t psnip_safe_ushort_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(USHRT_MAX, 0xffffffffffffffffULL) +typedef psnip_uint64_t psnip_safe_ushort_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (USHRT_MAX <= 0xffffffffffffffffULL) +typedef psnip_safe_uint128_t psnip_safe_ushort_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_USHRT +#endif + +#define PSNIP_SAFE_HAVE_LARGER_INT +#if PSNIP_SAFE_IS_LARGER(INT_MAX, LONG_MAX) +typedef long psnip_safe_int_larger; +#elif PSNIP_SAFE_IS_LARGER(INT_MAX, LLONG_MAX) +typedef long long psnip_safe_int_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(INT_MAX, 0x7fff) +typedef psnip_int16_t psnip_safe_int_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(INT_MAX, 0x7fffffffLL) +typedef psnip_int32_t psnip_safe_int_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(INT_MAX, 0x7fffffffffffffffLL) +typedef psnip_int64_t psnip_safe_int_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (INT_MAX <= 0x7fffffffffffffffLL) +typedef psnip_safe_int128_t psnip_safe_int_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_INT +#endif + +#define PSNIP_SAFE_HAVE_LARGER_UINT +#if PSNIP_SAFE_IS_LARGER(UINT_MAX, ULONG_MAX) +typedef unsigned long psnip_safe_uint_larger; +#elif PSNIP_SAFE_IS_LARGER(UINT_MAX, ULLONG_MAX) +typedef unsigned long long psnip_safe_uint_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(UINT_MAX, 0xffff) +typedef psnip_uint16_t psnip_safe_uint_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(UINT_MAX, 0xffffffffUL) +typedef psnip_uint32_t psnip_safe_uint_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(UINT_MAX, 0xffffffffffffffffULL) +typedef psnip_uint64_t psnip_safe_uint_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (UINT_MAX <= 0xffffffffffffffffULL) +typedef psnip_safe_uint128_t psnip_safe_uint_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_UINT +#endif + +#define PSNIP_SAFE_HAVE_LARGER_LONG +#if PSNIP_SAFE_IS_LARGER(LONG_MAX, LLONG_MAX) +typedef long long psnip_safe_long_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(LONG_MAX, 0x7fff) +typedef psnip_int16_t psnip_safe_long_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(LONG_MAX, 0x7fffffffLL) +typedef psnip_int32_t psnip_safe_long_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(LONG_MAX, 0x7fffffffffffffffLL) +typedef psnip_int64_t psnip_safe_long_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (LONG_MAX <= 0x7fffffffffffffffLL) +typedef psnip_safe_int128_t psnip_safe_long_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_LONG +#endif + +#define PSNIP_SAFE_HAVE_LARGER_ULONG +#if PSNIP_SAFE_IS_LARGER(ULONG_MAX, ULLONG_MAX) +typedef unsigned long long psnip_safe_ulong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(ULONG_MAX, 0xffff) +typedef psnip_uint16_t psnip_safe_ulong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(ULONG_MAX, 0xffffffffUL) +typedef psnip_uint32_t psnip_safe_ulong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(ULONG_MAX, 0xffffffffffffffffULL) +typedef psnip_uint64_t psnip_safe_ulong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (ULONG_MAX <= 0xffffffffffffffffULL) +typedef psnip_safe_uint128_t psnip_safe_ulong_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_ULONG +#endif + +#define PSNIP_SAFE_HAVE_LARGER_LLONG +#if !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(LLONG_MAX, 0x7fff) +typedef psnip_int16_t psnip_safe_llong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(LLONG_MAX, 0x7fffffffLL) +typedef psnip_int32_t psnip_safe_llong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(LLONG_MAX, 0x7fffffffffffffffLL) +typedef psnip_int64_t psnip_safe_llong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (LLONG_MAX <= 0x7fffffffffffffffLL) +typedef psnip_safe_int128_t psnip_safe_llong_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_LLONG +#endif + +#define PSNIP_SAFE_HAVE_LARGER_ULLONG +#if !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(ULLONG_MAX, 0xffff) +typedef psnip_uint16_t psnip_safe_ullong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(ULLONG_MAX, 0xffffffffUL) +typedef psnip_uint32_t psnip_safe_ullong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(ULLONG_MAX, 0xffffffffffffffffULL) +typedef psnip_uint64_t psnip_safe_ullong_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (ULLONG_MAX <= 0xffffffffffffffffULL) +typedef psnip_safe_uint128_t psnip_safe_ullong_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_ULLONG +#endif + +#if defined(PSNIP_SAFE_SIZE_MAX) +#define PSNIP_SAFE_HAVE_LARGER_SIZE +#if PSNIP_SAFE_IS_LARGER(PSNIP_SAFE_SIZE_MAX, USHRT_MAX) +typedef unsigned short psnip_safe_size_larger; +#elif PSNIP_SAFE_IS_LARGER(PSNIP_SAFE_SIZE_MAX, UINT_MAX) +typedef unsigned int psnip_safe_size_larger; +#elif PSNIP_SAFE_IS_LARGER(PSNIP_SAFE_SIZE_MAX, ULONG_MAX) +typedef unsigned long psnip_safe_size_larger; +#elif PSNIP_SAFE_IS_LARGER(PSNIP_SAFE_SIZE_MAX, ULLONG_MAX) +typedef unsigned long long psnip_safe_size_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(PSNIP_SAFE_SIZE_MAX, 0xffff) +typedef psnip_uint16_t psnip_safe_size_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(PSNIP_SAFE_SIZE_MAX, 0xffffffffUL) +typedef psnip_uint32_t psnip_safe_size_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && PSNIP_SAFE_IS_LARGER(PSNIP_SAFE_SIZE_MAX, 0xffffffffffffffffULL) +typedef psnip_uint64_t psnip_safe_size_larger; +#elif !defined(PSNIP_SAFE_NO_FIXED) && defined(PSNIP_SAFE_HAVE_128) && (PSNIP_SAFE_SIZE_MAX <= 0xffffffffffffffffULL) +typedef psnip_safe_uint128_t psnip_safe_size_larger; +#else +#undef PSNIP_SAFE_HAVE_LARGER_SIZE +#endif +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_SCHAR) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(signed char, schar) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_UCHAR) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(unsigned char, uchar) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_CHAR) +#if CHAR_MIN == 0 +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(char, char) +#else +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(char, char) +#endif +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_SHORT) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(short, short) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_USHORT) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(unsigned short, ushort) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_INT) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(int, int) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_UINT) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(unsigned int, uint) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_LONG) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(long, long) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_ULONG) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(unsigned long, ulong) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_LLONG) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(long long, llong) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_ULLONG) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(unsigned long long, ullong) +#endif + +#if defined(PSNIP_SAFE_HAVE_LARGER_SIZE) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(size_t, size) +#endif + +#if !defined(PSNIP_SAFE_NO_FIXED) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(psnip_int8_t, int8) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(psnip_uint8_t, uint8) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(psnip_int16_t, int16) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(psnip_uint16_t, uint16) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(psnip_int32_t, int32) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(psnip_uint32_t, uint32) +#if defined(PSNIP_SAFE_HAVE_128) +PSNIP_SAFE_DEFINE_LARGER_SIGNED_OPS(psnip_int64_t, int64) +PSNIP_SAFE_DEFINE_LARGER_UNSIGNED_OPS(psnip_uint64_t, uint64) +#endif +#endif + +#endif /* !defined(PSNIP_SAFE_NO_PROMOTIONS) */ + +#define PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(T, name, op_name) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_##op_name(T* res, T a, T b) { \ + return !__builtin_##op_name##_overflow(a, b, res); \ + } + +#define PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(T, name, op_name, min, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_##op_name(T* res, T a, T b) { \ + const psnip_safe_##name##_larger r = psnip_safe_larger_##name##_##op_name(a, b); \ + *res = (T) r; \ + return (r >= min) && (r <= max); \ + } + +#define PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(T, name, op_name, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_##op_name(T* res, T a, T b) { \ + const psnip_safe_##name##_larger r = psnip_safe_larger_##name##_##op_name(a, b); \ + *res = (T) r; \ + return (r <= max); \ + } + +#define PSNIP_SAFE_DEFINE_SIGNED_ADD(T, name, min, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_add (T* res, T a, T b) { \ + psnip_safe_bool r = !( ((b > 0) && (a > (max - b))) || \ + ((b < 0) && (a < (min - b))) ); \ + if(PSNIP_SAFE_LIKELY(r)) \ + *res = a + b; \ + return r; \ + } + +#define PSNIP_SAFE_DEFINE_UNSIGNED_ADD(T, name, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_add (T* res, T a, T b) { \ + *res = (T) (a + b); \ + return !PSNIP_SAFE_UNLIKELY((b > 0) && (a > (max - b))); \ + } + +#define PSNIP_SAFE_DEFINE_SIGNED_SUB(T, name, min, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_sub (T* res, T a, T b) { \ + psnip_safe_bool r = !((b > 0 && a < (min + b)) || \ + (b < 0 && a > (max + b))); \ + if(PSNIP_SAFE_LIKELY(r)) \ + *res = a - b; \ + return r; \ + } + +#define PSNIP_SAFE_DEFINE_UNSIGNED_SUB(T, name, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_sub (T* res, T a, T b) { \ + *res = a - b; \ + return !PSNIP_SAFE_UNLIKELY(b > a); \ + } + +#define PSNIP_SAFE_DEFINE_SIGNED_MUL(T, name, min, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_mul (T* res, T a, T b) { \ + psnip_safe_bool r = 1; \ + if (a > 0) { \ + if (b > 0) { \ + if (a > (max / b)) { \ + r = 0; \ + } \ + } else { \ + if (b < (min / a)) { \ + r = 0; \ + } \ + } \ + } else { \ + if (b > 0) { \ + if (a < (min / b)) { \ + r = 0; \ + } \ + } else { \ + if ( (a != 0) && (b < (max / a))) { \ + r = 0; \ + } \ + } \ + } \ + if(PSNIP_SAFE_LIKELY(r)) \ + *res = a * b; \ + return r; \ + } + +#define PSNIP_SAFE_DEFINE_UNSIGNED_MUL(T, name, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_mul (T* res, T a, T b) { \ + *res = (T) (a * b); \ + return !PSNIP_SAFE_UNLIKELY((a > 0) && (b > 0) && (a > (max / b))); \ + } + +#define PSNIP_SAFE_DEFINE_SIGNED_DIV(T, name, min, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_div (T* res, T a, T b) { \ + if (PSNIP_SAFE_UNLIKELY(b == 0)) { \ + *res = 0; \ + return 0; \ + } else if (PSNIP_SAFE_UNLIKELY(a == min && b == -1)) { \ + *res = min; \ + return 0; \ + } else { \ + *res = (T) (a / b); \ + return 1; \ + } \ + } + +#define PSNIP_SAFE_DEFINE_UNSIGNED_DIV(T, name, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_div (T* res, T a, T b) { \ + if (PSNIP_SAFE_UNLIKELY(b == 0)) { \ + *res = 0; \ + return 0; \ + } else { \ + *res = a / b; \ + return 1; \ + } \ + } + +#define PSNIP_SAFE_DEFINE_SIGNED_MOD(T, name, min, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_mod (T* res, T a, T b) { \ + if (PSNIP_SAFE_UNLIKELY(b == 0)) { \ + *res = 0; \ + return 0; \ + } else if (PSNIP_SAFE_UNLIKELY(a == min && b == -1)) { \ + *res = min; \ + return 0; \ + } else { \ + *res = (T) (a % b); \ + return 1; \ + } \ + } + +#define PSNIP_SAFE_DEFINE_UNSIGNED_MOD(T, name, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_mod (T* res, T a, T b) { \ + if (PSNIP_SAFE_UNLIKELY(b == 0)) { \ + *res = 0; \ + return 0; \ + } else { \ + *res = a % b; \ + return 1; \ + } \ + } + +#define PSNIP_SAFE_DEFINE_SIGNED_NEG(T, name, min, max) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_neg (T* res, T value) { \ + psnip_safe_bool r = value != min; \ + *res = PSNIP_SAFE_LIKELY(r) ? -value : max; \ + return r; \ + } + +#define PSNIP_SAFE_DEFINE_INTSAFE(T, name, op, isf) \ + PSNIP_SAFE__FUNCTION psnip_safe_bool \ + psnip_safe_##name##_##op (T* res, T a, T b) { \ + return isf(a, b, res) == S_OK; \ + } + +#if CHAR_MIN == 0 +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(char, char, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(char, char, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(char, char, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_CHAR) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(char, char, add, CHAR_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(char, char, sub, CHAR_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(char, char, mul, CHAR_MAX) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(char, char, CHAR_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(char, char, CHAR_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(char, char, CHAR_MAX) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(char, char, CHAR_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(char, char, CHAR_MAX) +#else /* CHAR_MIN != 0 */ +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(char, char, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(char, char, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(char, char, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_CHAR) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(char, char, add, CHAR_MIN, CHAR_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(char, char, sub, CHAR_MIN, CHAR_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(char, char, mul, CHAR_MIN, CHAR_MAX) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(char, char, CHAR_MIN, CHAR_MAX) +PSNIP_SAFE_DEFINE_SIGNED_SUB(char, char, CHAR_MIN, CHAR_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MUL(char, char, CHAR_MIN, CHAR_MAX) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(char, char, CHAR_MIN, CHAR_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MOD(char, char, CHAR_MIN, CHAR_MAX) +PSNIP_SAFE_DEFINE_SIGNED_NEG(char, char, CHAR_MIN, CHAR_MAX) +#endif + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(signed char, schar, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(signed char, schar, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(signed char, schar, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_SCHAR) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(signed char, schar, add, SCHAR_MIN, SCHAR_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(signed char, schar, sub, SCHAR_MIN, SCHAR_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(signed char, schar, mul, SCHAR_MIN, SCHAR_MAX) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(signed char, schar, SCHAR_MIN, SCHAR_MAX) +PSNIP_SAFE_DEFINE_SIGNED_SUB(signed char, schar, SCHAR_MIN, SCHAR_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MUL(signed char, schar, SCHAR_MIN, SCHAR_MAX) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(signed char, schar, SCHAR_MIN, SCHAR_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MOD(signed char, schar, SCHAR_MIN, SCHAR_MAX) +PSNIP_SAFE_DEFINE_SIGNED_NEG(signed char, schar, SCHAR_MIN, SCHAR_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned char, uchar, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned char, uchar, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned char, uchar, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_UCHAR) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned char, uchar, add, UCHAR_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned char, uchar, sub, UCHAR_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned char, uchar, mul, UCHAR_MAX) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(unsigned char, uchar, UCHAR_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(unsigned char, uchar, UCHAR_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(unsigned char, uchar, UCHAR_MAX) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(unsigned char, uchar, UCHAR_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(unsigned char, uchar, UCHAR_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(short, short, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(short, short, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(short, short, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_SHORT) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(short, short, add, SHRT_MIN, SHRT_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(short, short, sub, SHRT_MIN, SHRT_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(short, short, mul, SHRT_MIN, SHRT_MAX) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(short, short, SHRT_MIN, SHRT_MAX) +PSNIP_SAFE_DEFINE_SIGNED_SUB(short, short, SHRT_MIN, SHRT_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MUL(short, short, SHRT_MIN, SHRT_MAX) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(short, short, SHRT_MIN, SHRT_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MOD(short, short, SHRT_MIN, SHRT_MAX) +PSNIP_SAFE_DEFINE_SIGNED_NEG(short, short, SHRT_MIN, SHRT_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned short, ushort, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned short, ushort, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned short, ushort, mul) +#elif defined(PSNIP_SAFE_HAVE_INTSAFE_H) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned short, ushort, add, UShortAdd) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned short, ushort, sub, UShortSub) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned short, ushort, mul, UShortMult) +#elif defined(PSNIP_SAFE_HAVE_LARGER_USHORT) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned short, ushort, add, USHRT_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned short, ushort, sub, USHRT_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned short, ushort, mul, USHRT_MAX) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(unsigned short, ushort, USHRT_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(unsigned short, ushort, USHRT_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(unsigned short, ushort, USHRT_MAX) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(unsigned short, ushort, USHRT_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(unsigned short, ushort, USHRT_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(int, int, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(int, int, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(int, int, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_INT) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(int, int, add, INT_MIN, INT_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(int, int, sub, INT_MIN, INT_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(int, int, mul, INT_MIN, INT_MAX) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(int, int, INT_MIN, INT_MAX) +PSNIP_SAFE_DEFINE_SIGNED_SUB(int, int, INT_MIN, INT_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MUL(int, int, INT_MIN, INT_MAX) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(int, int, INT_MIN, INT_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MOD(int, int, INT_MIN, INT_MAX) +PSNIP_SAFE_DEFINE_SIGNED_NEG(int, int, INT_MIN, INT_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned int, uint, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned int, uint, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned int, uint, mul) +#elif defined(PSNIP_SAFE_HAVE_INTSAFE_H) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned int, uint, add, UIntAdd) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned int, uint, sub, UIntSub) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned int, uint, mul, UIntMult) +#elif defined(PSNIP_SAFE_HAVE_LARGER_UINT) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned int, uint, add, UINT_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned int, uint, sub, UINT_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned int, uint, mul, UINT_MAX) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(unsigned int, uint, UINT_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(unsigned int, uint, UINT_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(unsigned int, uint, UINT_MAX) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(unsigned int, uint, UINT_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(unsigned int, uint, UINT_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(long, long, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(long, long, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(long, long, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_LONG) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(long, long, add, LONG_MIN, LONG_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(long, long, sub, LONG_MIN, LONG_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(long, long, mul, LONG_MIN, LONG_MAX) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(long, long, LONG_MIN, LONG_MAX) +PSNIP_SAFE_DEFINE_SIGNED_SUB(long, long, LONG_MIN, LONG_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MUL(long, long, LONG_MIN, LONG_MAX) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(long, long, LONG_MIN, LONG_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MOD(long, long, LONG_MIN, LONG_MAX) +PSNIP_SAFE_DEFINE_SIGNED_NEG(long, long, LONG_MIN, LONG_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned long, ulong, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned long, ulong, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned long, ulong, mul) +#elif defined(PSNIP_SAFE_HAVE_INTSAFE_H) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned long, ulong, add, ULongAdd) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned long, ulong, sub, ULongSub) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned long, ulong, mul, ULongMult) +#elif defined(PSNIP_SAFE_HAVE_LARGER_ULONG) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned long, ulong, add, ULONG_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned long, ulong, sub, ULONG_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned long, ulong, mul, ULONG_MAX) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(unsigned long, ulong, ULONG_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(unsigned long, ulong, ULONG_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(unsigned long, ulong, ULONG_MAX) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(unsigned long, ulong, ULONG_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(unsigned long, ulong, ULONG_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(long long, llong, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(long long, llong, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(long long, llong, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_LLONG) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(long long, llong, add, LLONG_MIN, LLONG_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(long long, llong, sub, LLONG_MIN, LLONG_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(long long, llong, mul, LLONG_MIN, LLONG_MAX) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(long long, llong, LLONG_MIN, LLONG_MAX) +PSNIP_SAFE_DEFINE_SIGNED_SUB(long long, llong, LLONG_MIN, LLONG_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MUL(long long, llong, LLONG_MIN, LLONG_MAX) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(long long, llong, LLONG_MIN, LLONG_MAX) +PSNIP_SAFE_DEFINE_SIGNED_MOD(long long, llong, LLONG_MIN, LLONG_MAX) +PSNIP_SAFE_DEFINE_SIGNED_NEG(long long, llong, LLONG_MIN, LLONG_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned long long, ullong, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned long long, ullong, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(unsigned long long, ullong, mul) +#elif defined(PSNIP_SAFE_HAVE_INTSAFE_H) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned long long, ullong, add, ULongLongAdd) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned long long, ullong, sub, ULongLongSub) +PSNIP_SAFE_DEFINE_INTSAFE(unsigned long long, ullong, mul, ULongLongMult) +#elif defined(PSNIP_SAFE_HAVE_LARGER_ULLONG) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned long long, ullong, add, ULLONG_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned long long, ullong, sub, ULLONG_MAX) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(unsigned long long, ullong, mul, ULLONG_MAX) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(unsigned long long, ullong, ULLONG_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(unsigned long long, ullong, ULLONG_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(unsigned long long, ullong, ULLONG_MAX) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(unsigned long long, ullong, ULLONG_MAX) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(unsigned long long, ullong, ULLONG_MAX) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(size_t, size, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(size_t, size, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(size_t, size, mul) +#elif defined(PSNIP_SAFE_HAVE_INTSAFE_H) +PSNIP_SAFE_DEFINE_INTSAFE(size_t, size, add, SizeTAdd) +PSNIP_SAFE_DEFINE_INTSAFE(size_t, size, sub, SizeTSub) +PSNIP_SAFE_DEFINE_INTSAFE(size_t, size, mul, SizeTMult) +#elif defined(PSNIP_SAFE_HAVE_LARGER_SIZE) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(size_t, size, add, PSNIP_SAFE__SIZE_MAX_RT) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(size_t, size, sub, PSNIP_SAFE__SIZE_MAX_RT) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(size_t, size, mul, PSNIP_SAFE__SIZE_MAX_RT) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(size_t, size, PSNIP_SAFE__SIZE_MAX_RT) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(size_t, size, PSNIP_SAFE__SIZE_MAX_RT) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(size_t, size, PSNIP_SAFE__SIZE_MAX_RT) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(size_t, size, PSNIP_SAFE__SIZE_MAX_RT) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(size_t, size, PSNIP_SAFE__SIZE_MAX_RT) + +#if !defined(PSNIP_SAFE_NO_FIXED) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int8_t, int8, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int8_t, int8, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int8_t, int8, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_INT8) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int8_t, int8, add, (-0x7fLL-1), 0x7f) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int8_t, int8, sub, (-0x7fLL-1), 0x7f) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int8_t, int8, mul, (-0x7fLL-1), 0x7f) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(psnip_int8_t, int8, (-0x7fLL-1), 0x7f) +PSNIP_SAFE_DEFINE_SIGNED_SUB(psnip_int8_t, int8, (-0x7fLL-1), 0x7f) +PSNIP_SAFE_DEFINE_SIGNED_MUL(psnip_int8_t, int8, (-0x7fLL-1), 0x7f) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(psnip_int8_t, int8, (-0x7fLL-1), 0x7f) +PSNIP_SAFE_DEFINE_SIGNED_MOD(psnip_int8_t, int8, (-0x7fLL-1), 0x7f) +PSNIP_SAFE_DEFINE_SIGNED_NEG(psnip_int8_t, int8, (-0x7fLL-1), 0x7f) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint8_t, uint8, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint8_t, uint8, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint8_t, uint8, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_UINT8) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint8_t, uint8, add, 0xff) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint8_t, uint8, sub, 0xff) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint8_t, uint8, mul, 0xff) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(psnip_uint8_t, uint8, 0xff) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(psnip_uint8_t, uint8, 0xff) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(psnip_uint8_t, uint8, 0xff) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(psnip_uint8_t, uint8, 0xff) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(psnip_uint8_t, uint8, 0xff) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int16_t, int16, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int16_t, int16, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int16_t, int16, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_INT16) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int16_t, int16, add, (-32767-1), 0x7fff) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int16_t, int16, sub, (-32767-1), 0x7fff) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int16_t, int16, mul, (-32767-1), 0x7fff) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(psnip_int16_t, int16, (-32767-1), 0x7fff) +PSNIP_SAFE_DEFINE_SIGNED_SUB(psnip_int16_t, int16, (-32767-1), 0x7fff) +PSNIP_SAFE_DEFINE_SIGNED_MUL(psnip_int16_t, int16, (-32767-1), 0x7fff) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(psnip_int16_t, int16, (-32767-1), 0x7fff) +PSNIP_SAFE_DEFINE_SIGNED_MOD(psnip_int16_t, int16, (-32767-1), 0x7fff) +PSNIP_SAFE_DEFINE_SIGNED_NEG(psnip_int16_t, int16, (-32767-1), 0x7fff) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint16_t, uint16, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint16_t, uint16, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint16_t, uint16, mul) +#elif defined(PSNIP_SAFE_HAVE_INTSAFE_H) && defined(_WIN32) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint16_t, uint16, add, UShortAdd) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint16_t, uint16, sub, UShortSub) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint16_t, uint16, mul, UShortMult) +#elif defined(PSNIP_SAFE_HAVE_LARGER_UINT16) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint16_t, uint16, add, 0xffff) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint16_t, uint16, sub, 0xffff) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint16_t, uint16, mul, 0xffff) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(psnip_uint16_t, uint16, 0xffff) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(psnip_uint16_t, uint16, 0xffff) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(psnip_uint16_t, uint16, 0xffff) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(psnip_uint16_t, uint16, 0xffff) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(psnip_uint16_t, uint16, 0xffff) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int32_t, int32, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int32_t, int32, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int32_t, int32, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_INT32) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int32_t, int32, add, (-0x7fffffffLL-1), 0x7fffffffLL) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int32_t, int32, sub, (-0x7fffffffLL-1), 0x7fffffffLL) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int32_t, int32, mul, (-0x7fffffffLL-1), 0x7fffffffLL) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(psnip_int32_t, int32, (-0x7fffffffLL-1), 0x7fffffffLL) +PSNIP_SAFE_DEFINE_SIGNED_SUB(psnip_int32_t, int32, (-0x7fffffffLL-1), 0x7fffffffLL) +PSNIP_SAFE_DEFINE_SIGNED_MUL(psnip_int32_t, int32, (-0x7fffffffLL-1), 0x7fffffffLL) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(psnip_int32_t, int32, (-0x7fffffffLL-1), 0x7fffffffLL) +PSNIP_SAFE_DEFINE_SIGNED_MOD(psnip_int32_t, int32, (-0x7fffffffLL-1), 0x7fffffffLL) +PSNIP_SAFE_DEFINE_SIGNED_NEG(psnip_int32_t, int32, (-0x7fffffffLL-1), 0x7fffffffLL) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint32_t, uint32, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint32_t, uint32, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint32_t, uint32, mul) +#elif defined(PSNIP_SAFE_HAVE_INTSAFE_H) && defined(_WIN32) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint32_t, uint32, add, UIntAdd) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint32_t, uint32, sub, UIntSub) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint32_t, uint32, mul, UIntMult) +#elif defined(PSNIP_SAFE_HAVE_LARGER_UINT32) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint32_t, uint32, add, 0xffffffffUL) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint32_t, uint32, sub, 0xffffffffUL) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint32_t, uint32, mul, 0xffffffffUL) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(psnip_uint32_t, uint32, 0xffffffffUL) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(psnip_uint32_t, uint32, 0xffffffffUL) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(psnip_uint32_t, uint32, 0xffffffffUL) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(psnip_uint32_t, uint32, 0xffffffffUL) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(psnip_uint32_t, uint32, 0xffffffffUL) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int64_t, int64, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int64_t, int64, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_int64_t, int64, mul) +#elif defined(PSNIP_SAFE_HAVE_LARGER_INT64) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int64_t, int64, add, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int64_t, int64, sub, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) +PSNIP_SAFE_DEFINE_PROMOTED_SIGNED_BINARY_OP(psnip_int64_t, int64, mul, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) +#else +PSNIP_SAFE_DEFINE_SIGNED_ADD(psnip_int64_t, int64, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) +PSNIP_SAFE_DEFINE_SIGNED_SUB(psnip_int64_t, int64, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) +PSNIP_SAFE_DEFINE_SIGNED_MUL(psnip_int64_t, int64, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) +#endif +PSNIP_SAFE_DEFINE_SIGNED_DIV(psnip_int64_t, int64, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) +PSNIP_SAFE_DEFINE_SIGNED_MOD(psnip_int64_t, int64, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) +PSNIP_SAFE_DEFINE_SIGNED_NEG(psnip_int64_t, int64, (-0x7fffffffffffffffLL-1), 0x7fffffffffffffffLL) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint64_t, uint64, add) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint64_t, uint64, sub) +PSNIP_SAFE_DEFINE_BUILTIN_BINARY_OP(psnip_uint64_t, uint64, mul) +#elif defined(PSNIP_SAFE_HAVE_INTSAFE_H) && defined(_WIN32) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint64_t, uint64, add, ULongLongAdd) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint64_t, uint64, sub, ULongLongSub) +PSNIP_SAFE_DEFINE_INTSAFE(psnip_uint64_t, uint64, mul, ULongLongMult) +#elif defined(PSNIP_SAFE_HAVE_LARGER_UINT64) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint64_t, uint64, add, 0xffffffffffffffffULL) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint64_t, uint64, sub, 0xffffffffffffffffULL) +PSNIP_SAFE_DEFINE_PROMOTED_UNSIGNED_BINARY_OP(psnip_uint64_t, uint64, mul, 0xffffffffffffffffULL) +#else +PSNIP_SAFE_DEFINE_UNSIGNED_ADD(psnip_uint64_t, uint64, 0xffffffffffffffffULL) +PSNIP_SAFE_DEFINE_UNSIGNED_SUB(psnip_uint64_t, uint64, 0xffffffffffffffffULL) +PSNIP_SAFE_DEFINE_UNSIGNED_MUL(psnip_uint64_t, uint64, 0xffffffffffffffffULL) +#endif +PSNIP_SAFE_DEFINE_UNSIGNED_DIV(psnip_uint64_t, uint64, 0xffffffffffffffffULL) +PSNIP_SAFE_DEFINE_UNSIGNED_MOD(psnip_uint64_t, uint64, 0xffffffffffffffffULL) + +#endif /* !defined(PSNIP_SAFE_NO_FIXED) */ + +#define PSNIP_SAFE_C11_GENERIC_SELECTION(res, op) \ + _Generic((*res), \ + char: psnip_safe_char_##op, \ + unsigned char: psnip_safe_uchar_##op, \ + short: psnip_safe_short_##op, \ + unsigned short: psnip_safe_ushort_##op, \ + int: psnip_safe_int_##op, \ + unsigned int: psnip_safe_uint_##op, \ + long: psnip_safe_long_##op, \ + unsigned long: psnip_safe_ulong_##op, \ + long long: psnip_safe_llong_##op, \ + unsigned long long: psnip_safe_ullong_##op) + +#define PSNIP_SAFE_C11_GENERIC_BINARY_OP(op, res, a, b) \ + PSNIP_SAFE_C11_GENERIC_SELECTION(res, op)(res, a, b) +#define PSNIP_SAFE_C11_GENERIC_UNARY_OP(op, res, v) \ + PSNIP_SAFE_C11_GENERIC_SELECTION(res, op)(res, v) + +#if defined(PSNIP_SAFE_HAVE_BUILTIN_OVERFLOW) +#define psnip_safe_add(res, a, b) !__builtin_add_overflow(a, b, res) +#define psnip_safe_sub(res, a, b) !__builtin_sub_overflow(a, b, res) +#define psnip_safe_mul(res, a, b) !__builtin_mul_overflow(a, b, res) +#define psnip_safe_div(res, a, b) !__builtin_div_overflow(a, b, res) +#define psnip_safe_mod(res, a, b) !__builtin_mod_overflow(a, b, res) +#define psnip_safe_neg(res, v) PSNIP_SAFE_C11_GENERIC_UNARY_OP (neg, res, v) + +#elif defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 201112L) +/* The are no fixed-length or size selections because they cause an + * error about _Generic specifying two compatible types. Hopefully + * this doesn't cause problems on exotic platforms, but if it does + * please let me know and I'll try to figure something out. */ + +#define psnip_safe_add(res, a, b) PSNIP_SAFE_C11_GENERIC_BINARY_OP(add, res, a, b) +#define psnip_safe_sub(res, a, b) PSNIP_SAFE_C11_GENERIC_BINARY_OP(sub, res, a, b) +#define psnip_safe_mul(res, a, b) PSNIP_SAFE_C11_GENERIC_BINARY_OP(mul, res, a, b) +#define psnip_safe_div(res, a, b) PSNIP_SAFE_C11_GENERIC_BINARY_OP(div, res, a, b) +#define psnip_safe_mod(res, a, b) PSNIP_SAFE_C11_GENERIC_BINARY_OP(mod, res, a, b) +#define psnip_safe_neg(res, v) PSNIP_SAFE_C11_GENERIC_UNARY_OP (neg, res, v) +#endif + +#if !defined(PSNIP_SAFE_HAVE_BUILTINS) && (defined(PSNIP_SAFE_EMULATE_NATIVE) || defined(PSNIP_BUILTIN_EMULATE_NATIVE)) +# define __builtin_sadd_overflow(a, b, res) psnip_safe_int_add(res, a, b) +# define __builtin_saddl_overflow(a, b, res) psnip_safe_long_add(res, a, b) +# define __builtin_saddll_overflow(a, b, res) psnip_safe_llong_add(res, a, b) +# define __builtin_uadd_overflow(a, b, res) psnip_safe_uint_add(res, a, b) +# define __builtin_uaddl_overflow(a, b, res) psnip_safe_ulong_add(res, a, b) +# define __builtin_uaddll_overflow(a, b, res) psnip_safe_ullong_add(res, a, b) + +# define __builtin_ssub_overflow(a, b, res) psnip_safe_int_sub(res, a, b) +# define __builtin_ssubl_overflow(a, b, res) psnip_safe_long_sub(res, a, b) +# define __builtin_ssubll_overflow(a, b, res) psnip_safe_llong_sub(res, a, b) +# define __builtin_usub_overflow(a, b, res) psnip_safe_uint_sub(res, a, b) +# define __builtin_usubl_overflow(a, b, res) psnip_safe_ulong_sub(res, a, b) +# define __builtin_usubll_overflow(a, b, res) psnip_safe_ullong_sub(res, a, b) + +# define __builtin_smul_overflow(a, b, res) psnip_safe_int_mul(res, a, b) +# define __builtin_smull_overflow(a, b, res) psnip_safe_long_mul(res, a, b) +# define __builtin_smulll_overflow(a, b, res) psnip_safe_llong_mul(res, a, b) +# define __builtin_umul_overflow(a, b, res) psnip_safe_uint_mul(res, a, b) +# define __builtin_umull_overflow(a, b, res) psnip_safe_ulong_mul(res, a, b) +# define __builtin_umulll_overflow(a, b, res) psnip_safe_ullong_mul(res, a, b) +#endif + +#endif /* !defined(PSNIP_SAFE_H) */