database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

Provide overflow safe integer math inline functions.

Browse Source 
It's not easy to get signed integer overflow checks correct and
fast. Therefore abstract the necessary infrastructure into a common
header providing addition, subtraction and multiplication for 16, 32,
64 bit signed integers.

The new macros aren't yet used, but a followup commit will convert
several open coded overflow checks.

Author: Andres Freund, with some code stolen from Greg Stark
Reviewed-By: Robert Haas
Discussion: https://postgr.es/m/20171024103954.ztmatprlglz3rwke@alap3.anarazel.de
This commit is contained in:
Andres Freund
2017-10-29 22:13:54 -07:00
parent 95b52351fe
commit 4d6ad31257
6 changed files with 304 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

239
src/include/common/int.h Normal file
View File

@ -0,0 +1,239 @@
/*-------------------------------------------------------------------------
*
* int.h
* Routines to perform integer math, while checking for overflows.
*
* The routines in this file are intended to be well defined C, without
* relying on compiler flags like -fwrapv.
*
* To reduce the overhead of these routines try to use compiler intrinsics
* where available. That's not that important for the 16, 32 bit cases, but
* the 64 bit cases can be considerably faster with intrinsics. In case no
* intrinsics are available 128 bit math is used where available.
*
* Copyright (c) 2017, PostgreSQL Global Development Group
*
* src/include/common/int.h
*
*-------------------------------------------------------------------------
*/
#ifndef COMMON_INT_H
#define COMMON_INT_H
/*
* If a + b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_add_s16_overflow(int16 a, int16 b, int16 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_add_overflow(a, b, result);
#else
int32 res = (int32) a + (int32) b;
if (res > PG_INT16_MAX || res < PG_INT16_MIN)
return true;
*result = (int16) res;
return false;
#endif
}
/*
* If a - b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_sub_s16_overflow(int16 a, int16 b, int16 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_sub_overflow(a, b, result);
#else
int32 res = (int32) a - (int32) b;
if (res > PG_INT16_MAX || res < PG_INT16_MIN)
return true;
*result = (int16) res;
return false;
#endif
}
/*
* If a * b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_mul_s16_overflow(int16 a, int16 b, int16 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_mul_overflow(a, b, result);
#else
int32 res = (int32) a * (int32) b;
if (res > PG_INT16_MAX || res < PG_INT16_MIN)
return true;
*result = (int16) res;
return false;
#endif
}
/*
* If a + b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_add_s32_overflow(int32 a, int32 b, int32 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_add_overflow(a, b, result);
#else
int64 res = (int64) a + (int64) b;
if (res > PG_INT32_MAX || res < PG_INT32_MIN)
return true;
*result = (int32) res;
return false;
#endif
}
/*
* If a - b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_sub_s32_overflow(int32 a, int32 b, int32 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_sub_overflow(a, b, result);
#else
int64 res = (int64) a - (int64) b;
if (res > PG_INT32_MAX || res < PG_INT32_MIN)
return true;
*result = (int32) res;
return false;
#endif
}
/*
* If a * b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_mul_s32_overflow(int32 a, int32 b, int32 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_mul_overflow(a, b, result);
#else
int64 res = (int64) a * (int64) b;
if (res > PG_INT32_MAX || res < PG_INT32_MIN)
return true;
*result = (int32) res;
return false;
#endif
}
/*
* If a + b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_add_s64_overflow(int64 a, int64 b, int64 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_add_overflow(a, b, result);
#elif defined(HAVE_INT128)
int128 res = (int128) a + (int128) b;
if (res > PG_INT64_MAX || res < PG_INT64_MIN)
return true;
*result = (int64) res;
return false;
#else
if ((a > 0 && b > 0 && a > PG_INT64_MAX - b) ||
(a < 0 && b < 0 && a < PG_INT64_MIN - b))
return true;
*result = a + b;
return false;
#endif
}
/*
* If a - b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_sub_s64_overflow(int64 a, int64 b, int64 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_sub_overflow(a, b, result);
#elif defined(HAVE_INT128)
int128 res = (int128) a - (int128) b;
if (res > PG_INT64_MAX || res < PG_INT64_MIN)
return true;
*result = (int64) res;
return false;
#else
if ((a < 0 && b > 0 && a < PG_INT64_MIN + b) ||
(a > 0 && b < 0 && a > PG_INT64_MAX + b))
return true;
*result = a - b;
return false;
#endif
}
/*
* If a * b overflows, return true, otherwise store the result of a + b into
* *result. The content of *result is implementation defined in case of
* overflow.
*/
static inline bool
pg_mul_s64_overflow(int64 a, int64 b, int64 *result)
{
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
return __builtin_mul_overflow(a, b, result);
#elif defined(HAVE_INT128)
int128 res = (int128) a * (int128) b;
if (res > PG_INT64_MAX || res < PG_INT64_MIN)
return true;
*result = (int64) res;
return false;
#else
/*
* Overflow can only happen if at least one value is outside the range
* sqrt(min)..sqrt(max) so check that first as the division can be quite a
* bit more expensive than the multiplication.
*
* Multiplying by 0 or 1 can't overflow of course and checking for 0
* separately avoids any risk of dividing by 0. Be careful about dividing
* INT_MIN by -1 also, note reversing the a and b to ensure we're always
* dividing it by a positive value.
*
*/
if ((a > PG_INT32_MAX || a < PG_INT32_MIN ||
b > PG_INT32_MAX || b < PG_INT32_MIN) &&
a != 0 && a != 1 && b != 0 && b != 1 &&
((a > 0 && b > 0 && a > PG_INT64_MAX / b) ||
(a > 0 && b < 0 && b < PG_INT64_MIN / a) ||
(a < 0 && b > 0 && a < PG_INT64_MIN / b) ||
(a < 0 && b < 0 && a < PG_INT64_MAX / b)))
{
return true;
}
*result = a * b;
return false;
#endif
}
#endif /* COMMON_INT_H */

3
src/include/pg_config.h.in
View File

@ -690,6 +690,9 @@
/* Define to 1 if your compiler understands __builtin_constant_p. */
#undef HAVE__BUILTIN_CONSTANT_P
/* Define to 1 if your compiler understands __builtin_$op_overflow. */
#undef HAVE__BUILTIN_OP_OVERFLOW
/* Define to 1 if your compiler understands __builtin_types_compatible_p. */
#undef HAVE__BUILTIN_TYPES_COMPATIBLE_P

3
src/include/pg_config.h.win32
View File

@ -515,6 +515,9 @@
/* Define to 1 if your compiler understands __builtin_constant_p. */
/* #undef HAVE__BUILTIN_CONSTANT_P */
/* Define to 1 if your compiler understands __builtin_$op_overflow. */
/* #undef HAVE__BUILTIN_OP_OVERFLOW */
/* Define to 1 if your compiler understands __builtin_types_compatible_p. */
/* #undef HAVE__BUILTIN_TYPES_COMPATIBLE_P */