OLD | NEW |
---|---|
(Empty) | |
1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef BASE_SAFE_MATH_H_ | |
6 #define BASE_SAFE_MATH_H_ | |
7 | |
8 #include "base/numerics/safe_math_impl.h" | |
9 | |
10 namespace base { | |
11 | |
12 namespace internal { | |
13 | |
14 // CheckedNumeric implements all the logic and operators for detecting integer | |
15 // boundary conditions such as overflow, underflow, and invalid conversions. | |
16 // The CheckedNumeric type implicitly converts from floating point and integer | |
17 // data types, and contains overloads for basic arithmetic operations (i.e.: +, | |
18 // -, *, /, %). | |
19 // | |
20 // The following methods convert from CheckedNumeric to standard numeric values: | |
21 // IsValid() - Returns true if the underlying numeric value is valid (i.e. has | |
22 // has not wrapped and is not the result of an invalid conversion). | |
23 // ValueOrDie() - Returns the underlying value. If the state is not valid this | |
24 // call will crash on a CHECK. | |
25 // ValueOrDefault() - Returns the current value, or the supplied default if the | |
26 // state is not valid. | |
27 // ValueFloating() - Returns the underlying floating point value (valid only | |
28 // only for floating point CheckedNumeric types). | |
29 // | |
30 // Bitwise operations are explicitly not supported, because correct | |
31 // handling of some cases (e.g. sign manipulation) is ambiguous. Comparison | |
32 // operations are explicitly not supported because they could result in a crash | |
33 // on a CHECK condition. You should use patterns like the following for these | |
34 // operations: | |
35 // Bitwise operation: | |
36 // CheckedNumeric<int> checked_int = untrusted_input_value; | |
37 // int x = checked_int.ValueOrDefault(0) | kFlagValues; | |
38 // Comparison: | |
39 // CheckedNumeric<size_t> checked_size; | |
40 // CheckedNumeric<int> checked_size = untrusted_input_value; | |
41 // checked_size = checked_size + HEADER LENGTH; | |
42 // if (checked_size.IsValid() && checked_size.ValueOrDie() < buffer_size) | |
43 // Do stuff... | |
44 template <typename T> | |
45 class CheckedNumeric { | |
46 private: | |
47 CheckedNumericState<T> state_; | |
48 | |
49 public: | |
50 typedef T type; | |
51 template <typename Src> | |
52 friend class CheckedNumeric; | |
Ryan Sleevi
2014/02/24 23:37:44
indentation seems wonky on this. One line?
templa
jschuh
2014/02/25 22:34:43
Done (but for the record, "git cl format" hates te
| |
53 | |
54 CheckedNumeric() {} | |
55 | |
56 // Copy constructor. | |
57 template <typename Src> | |
58 CheckedNumeric(const CheckedNumeric<Src>& rhs) | |
59 : state_(rhs.state_.value(), rhs.state_.validity()) {} | |
60 | |
61 template <typename Src> | |
62 CheckedNumeric(Src value, RangeConstraint validity) | |
63 : state_(value, validity) {} | |
64 | |
65 // This is not an explicit constructor because we implicitly upgrade regular | |
66 // numerics to CheckedNumerics to make them easier to use. | |
67 template <typename Src> | |
68 CheckedNumeric(Src value) | |
69 : state_(value) { | |
70 COMPILE_ASSERT(std::numeric_limits<Src>::is_specialized, | |
71 argument_must_be_numeric); | |
72 } | |
73 | |
74 // validity() - DO NOT USE THIS IN EXTERNAL CODE - It is public right now for | |
75 // tests and to avoid a big matrix of friend operator overloads. But the | |
76 // values it returns are likely to change in the future. | |
77 // Returns: current validity state (i.e. valid, overflow, underflow, nan). | |
78 // TODO(jschuh): crbug.com/332611 Figure out and implement semantics for | |
79 // saturation/wrapping so we can expose this state consistently and implement | |
80 // saturated arithmetic. | |
81 RangeConstraint validity() const { return state_.validity(); } | |
82 | |
83 // IsValid() is the public API to test if a CheckedNumeric is currently valid. | |
84 bool IsValid() const { return validity() == RANGE_VALID; } | |
85 | |
86 // ValueUnsafe() - DO NOT USE THIS IN EXTERNAL CODE - It is public right now | |
87 // for tests and to avoid a big matrix of friend operator overloads. But the | |
88 // values it returns are likely to change in the future. | |
89 // Returns: the raw numeric value, regardless of the current state. | |
90 // TODO(jschuh): crbug.com/332611 Figure out and implement semantics for | |
91 // saturation/wrapping so we can expose this state consistently and implement | |
92 // saturated arithmetic. | |
93 T ValueUnsafe() const { return state_.value(); } | |
Ryan Sleevi
2014/02/24 23:37:44
Should you move these "Don't use in external code"
jschuh
2014/02/25 22:34:43
Done.
| |
94 | |
95 // ValueOrDie() The primary accessor for the underlying value. If the current | |
96 // state is not valid it will CHECK and crash. | |
97 T ValueOrDie() const { | |
98 CHECK(IsValid()); | |
99 return state_.value(); | |
100 } | |
101 | |
102 // ValueOrDefault(T default_value) A convenience method that returns the | |
103 // current value if the state is valid, and the supplied default_value for | |
104 // any other state. | |
105 T ValueOrDefault(T default_value) const { | |
106 return IsValid() ? state_.value() : default_value; | |
107 } | |
108 | |
109 // ValueFloating() - Since floating point values include their validity state, | |
110 // we provide an easy method for extracting them directly, without a risk of | |
111 // crashing on a CHECK. | |
112 T ValueFloating() const { | |
113 COMPILE_ASSERT(std::numeric_limits<T>::is_iec559, argument_must_be_float); | |
114 return CheckedNumeric<T>::cast(*this).ValueUnsafe(); | |
115 } | |
116 | |
117 // Prototypes for the supported arithmetic operator overloads. | |
118 template <typename Src> | |
119 CheckedNumeric& operator+=(Src rhs); | |
Ryan Sleevi
2014/02/24 23:37:44
same comments re: indenting above.
jschuh
2014/02/25 22:34:43
Done.
| |
120 template <typename Src> | |
121 CheckedNumeric& operator-=(Src rhs); | |
122 template <typename Src> | |
123 CheckedNumeric& operator*=(Src rhs); | |
124 template <typename Src> | |
125 CheckedNumeric& operator/=(Src rhs); | |
126 template <typename Src> | |
127 CheckedNumeric& operator%=(Src rhs); | |
128 | |
129 CheckedNumeric operator-() const { | |
130 RangeConstraint validity; | |
131 T value = CheckedNeg(state_.value(), &validity); | |
132 // Negation is always valid for floating point. | |
133 if (std::numeric_limits<T>::is_iec559) | |
134 return CheckedNumeric<T>(value); | |
135 | |
136 validity = MakeRangeConstraint(state_.validity() | validity); | |
137 return CheckedNumeric<T>(value, validity); | |
138 } | |
139 | |
140 CheckedNumeric Abs() const { | |
141 RangeConstraint validity; | |
142 T value = CheckedAbs(state_.value(), &validity); | |
143 // Absolute value is always valid for floating point. | |
144 if (std::numeric_limits<T>::is_iec559) | |
145 return CheckedNumeric<T>(value); | |
146 | |
147 validity = MakeRangeConstraint(state_.validity() | validity); | |
148 return CheckedNumeric<T>(value, validity); | |
149 } | |
150 | |
151 CheckedNumeric& operator++() { | |
152 *this += 1; | |
153 return *this; | |
154 } | |
155 | |
156 CheckedNumeric operator++(int) { | |
157 CheckedNumeric value = *this; | |
158 *this += 1; | |
159 return value; | |
160 } | |
161 | |
162 CheckedNumeric& operator--() { | |
163 *this -= 1; | |
164 return *this; | |
165 } | |
166 | |
167 CheckedNumeric operator--(int) { | |
168 CheckedNumeric value = *this; | |
169 *this -= 1; | |
170 return value; | |
171 } | |
172 | |
173 // These static methods behave like a convenience cast operator targeting | |
174 // the desired CheckedNumeric type. As an optimization, a reference is | |
175 // returned when Src is the same type as T. | |
176 template <typename Src> | |
177 static CheckedNumeric<T> cast( | |
178 Src u, | |
179 typename enable_if<std::numeric_limits<Src>::is_specialized, int>::type = | |
180 0) { | |
181 return u; | |
182 } | |
183 | |
184 template <typename Src> | |
185 static CheckedNumeric<T> cast( | |
186 const CheckedNumeric<Src>& u, | |
187 typename enable_if<!is_same<Src, T>::value, int>::type = 0) { | |
188 return u; | |
189 } | |
190 | |
191 static const CheckedNumeric<T>& cast(const CheckedNumeric<T>& u) { return u; } | |
192 }; | |
193 | |
194 // This is the boilerplate for the standard arithmetic operator overloads. A | |
195 // macro isn't the prettiest solution, but it beats rewriting these five times. | |
196 // Some details worth noting are: | |
197 // * We apply the standard arithmetic promotions. | |
198 // * We skip range checks for floating points. | |
199 // * We skip range checks for destination integers with sufficient range. | |
200 // TODO(jschuh): extract these out into templates. | |
201 #define BASE_NUMERIC_ARITHMETIC_OPERATORS(NAME, OP, COMPOUND_OP) \ | |
202 /* Binary arithmetic operator for CheckedNumerics of the same type. */ \ | |
203 template <typename T> \ | |
204 CheckedNumeric<typename ArithmeticPromotion<T>::type> operator OP( \ | |
205 const CheckedNumeric<T>& lhs, const CheckedNumeric<T>& rhs) { \ | |
206 typedef typename ArithmeticPromotion<T>::type Promotion; \ | |
207 /* Floating point always takes the fast path */ \ | |
208 if (std::numeric_limits<T>::is_iec559) \ | |
209 return CheckedNumeric<T>(lhs.ValueUnsafe() OP rhs.ValueUnsafe()); \ | |
210 if (IsIntegerArithmeticSafe<Promotion, T, T>::value) \ | |
211 return CheckedNumeric<Promotion>( \ | |
212 lhs.ValueUnsafe() OP rhs.ValueUnsafe(), \ | |
213 MakeRangeConstraint(rhs.validity() | lhs.validity())); \ | |
214 RangeConstraint validity = RANGE_VALID; \ | |
215 T result = Checked##NAME(static_cast<Promotion>(lhs.ValueUnsafe()), \ | |
216 static_cast<Promotion>(rhs.ValueUnsafe()), \ | |
217 &validity); \ | |
218 return CheckedNumeric<Promotion>( \ | |
219 result, \ | |
220 MakeRangeConstraint(validity | lhs.validity() | rhs.validity())); \ | |
221 } \ | |
222 /* Assignment arithmetic operator implementation from CheckedNumeric. */ \ | |
223 template <typename T> \ | |
224 template <typename Src> \ | |
225 CheckedNumeric<T>& CheckedNumeric<T>::operator COMPOUND_OP(Src rhs) { \ | |
226 *this = CheckedNumeric<T>::cast(*this) OP CheckedNumeric<Src>::cast(rhs); \ | |
227 return *this; \ | |
228 } \ | |
229 /* Binary arithmetic operator for CheckedNumeric of different type. */ \ | |
230 template <typename T, typename Src> \ | |
231 CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> operator OP( \ | |
232 const CheckedNumeric<Src>& lhs, const CheckedNumeric<T>& rhs) { \ | |
233 typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ | |
234 if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ | |
235 return CheckedNumeric<Promotion>( \ | |
236 lhs.ValueUnsafe() OP rhs.ValueUnsafe(), \ | |
237 MakeRangeConstraint(rhs.validity() | lhs.validity())); \ | |
238 return CheckedNumeric<Promotion>::cast(lhs) \ | |
239 OP CheckedNumeric<Promotion>::cast(rhs); \ | |
240 } \ | |
241 /* Binary arithmetic operator for left CheckedNumeric and right numeric. */ \ | |
242 template <typename T, typename Src> \ | |
243 CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> operator OP( \ | |
244 const CheckedNumeric<T>& lhs, Src rhs) { \ | |
245 typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ | |
246 if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ | |
247 return CheckedNumeric<Promotion>(lhs.ValueUnsafe() OP rhs, \ | |
248 lhs.validity()); \ | |
249 return CheckedNumeric<Promotion>::cast(lhs) \ | |
250 OP CheckedNumeric<Promotion>::cast(rhs); \ | |
251 } \ | |
252 /* Binary arithmetic operator for right numeric and left CheckedNumeric. */ \ | |
253 template <typename T, typename Src> \ | |
254 CheckedNumeric<typename ArithmeticPromotion<T, Src>::type> operator OP( \ | |
255 Src lhs, const CheckedNumeric<T>& rhs) { \ | |
256 typedef typename ArithmeticPromotion<T, Src>::type Promotion; \ | |
257 if (IsIntegerArithmeticSafe<Promotion, T, Src>::value) \ | |
258 return CheckedNumeric<Promotion>(lhs OP rhs.ValueUnsafe(), \ | |
259 rhs.validity()); \ | |
260 return CheckedNumeric<Promotion>::cast(lhs) \ | |
261 OP CheckedNumeric<Promotion>::cast(rhs); \ | |
262 } | |
263 | |
264 BASE_NUMERIC_ARITHMETIC_OPERATORS(Add, +, += ) | |
265 BASE_NUMERIC_ARITHMETIC_OPERATORS(Sub, -, -= ) | |
266 BASE_NUMERIC_ARITHMETIC_OPERATORS(Mul, *, *= ) | |
267 BASE_NUMERIC_ARITHMETIC_OPERATORS(Div, /, /= ) | |
268 BASE_NUMERIC_ARITHMETIC_OPERATORS(Mod, %, %= ) | |
269 | |
270 #undef BASE_NUMERIC_ARITHMETIC_OPERATORS | |
271 | |
272 } // namespace internal | |
273 | |
274 using internal::CheckedNumeric; | |
275 | |
276 } // namespace base | |
277 | |
278 #endif // BASE_SAFE_MATH_H_ | |
OLD | NEW |