1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #ifndef PDFIUM_THIRD_PARTY_BASE_SAFE_CONVERSIONS_IMPL_H_
6 #define PDFIUM_THIRD_PARTY_BASE_SAFE_CONVERSIONS_IMPL_H_
7 
8 #include <assert.h>
9 #include <limits>
10 
11 #include "third_party/base/macros.h"
12 
13 namespace pdfium {
14 namespace base {
15 namespace internal {
16 
17 // The std library doesn't provide a binary max_exponent for integers, however
18 // we can compute one by adding one to the number of non-sign bits. This allows
19 // for accurate range comparisons between floating point and integer types.
20 template <typename NumericType>
21 struct MaxExponent {
22   static const int value = std::numeric_limits<NumericType>::is_iec559
23                                ? std::numeric_limits<NumericType>::max_exponent
24                                : (sizeof(NumericType) * 8 + 1 -
25                                   std::numeric_limits<NumericType>::is_signed);
26 };
27 
28 enum IntegerRepresentation {
29   INTEGER_REPRESENTATION_UNSIGNED,
30   INTEGER_REPRESENTATION_SIGNED
31 };
32 
33 // A range for a given nunmeric Src type is contained for a given numeric Dst
34 // type if both numeric_limits<Src>::max() <= numeric_limits<Dst>::max() and
35 // numeric_limits<Src>::min() >= numeric_limits<Dst>::min() are true.
36 // We implement this as template specializations rather than simple static
37 // comparisons to ensure type correctness in our comparisons.
38 enum NumericRangeRepresentation {
39   NUMERIC_RANGE_NOT_CONTAINED,
40   NUMERIC_RANGE_CONTAINED
41 };
42 
43 // Helper templates to statically determine if our destination type can contain
44 // maximum and minimum values represented by the source type.
45 
46 template <
47     typename Dst,
48     typename Src,
49     IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed
50                                             ? INTEGER_REPRESENTATION_SIGNED
51                                             : INTEGER_REPRESENTATION_UNSIGNED,
52     IntegerRepresentation SrcSign =
53         std::numeric_limits<Src>::is_signed
54             ? INTEGER_REPRESENTATION_SIGNED
55             : INTEGER_REPRESENTATION_UNSIGNED >
56 struct StaticDstRangeRelationToSrcRange;
57 
58 // Same sign: Dst is guaranteed to contain Src only if its range is equal or
59 // larger.
60 template <typename Dst, typename Src, IntegerRepresentation Sign>
61 struct StaticDstRangeRelationToSrcRange<Dst, Src, Sign, Sign> {
62   static const NumericRangeRepresentation value =
63       MaxExponent<Dst>::value >= MaxExponent<Src>::value
64           ? NUMERIC_RANGE_CONTAINED
65           : NUMERIC_RANGE_NOT_CONTAINED;
66 };
67 
68 // Unsigned to signed: Dst is guaranteed to contain source only if its range is
69 // larger.
70 template <typename Dst, typename Src>
71 struct StaticDstRangeRelationToSrcRange<Dst,
72                                         Src,
73                                         INTEGER_REPRESENTATION_SIGNED,
74                                         INTEGER_REPRESENTATION_UNSIGNED> {
75   static const NumericRangeRepresentation value =
76       MaxExponent<Dst>::value > MaxExponent<Src>::value
77           ? NUMERIC_RANGE_CONTAINED
78           : NUMERIC_RANGE_NOT_CONTAINED;
79 };
80 
81 // Signed to unsigned: Dst cannot be statically determined to contain Src.
82 template <typename Dst, typename Src>
83 struct StaticDstRangeRelationToSrcRange<Dst,
84                                         Src,
85                                         INTEGER_REPRESENTATION_UNSIGNED,
86                                         INTEGER_REPRESENTATION_SIGNED> {
87   static const NumericRangeRepresentation value = NUMERIC_RANGE_NOT_CONTAINED;
88 };
89 
90 enum RangeConstraint {
91   RANGE_VALID = 0x0,  // Value can be represented by the destination type.
92   RANGE_UNDERFLOW = 0x1,  // Value would overflow.
93   RANGE_OVERFLOW = 0x2,  // Value would underflow.
94   RANGE_INVALID = RANGE_UNDERFLOW | RANGE_OVERFLOW  // Invalid (i.e. NaN).
95 };
96 
97 // Helper function for coercing an int back to a RangeContraint.
98 inline RangeConstraint GetRangeConstraint(int integer_range_constraint) {
99   assert(integer_range_constraint >= RANGE_VALID &&
100          integer_range_constraint <= RANGE_INVALID);
101   return static_cast<RangeConstraint>(integer_range_constraint);
102 }
103 
104 // This function creates a RangeConstraint from an upper and lower bound
105 // check by taking advantage of the fact that only NaN can be out of range in
106 // both directions at once.
107 inline RangeConstraint GetRangeConstraint(bool is_in_upper_bound,
108                                    bool is_in_lower_bound) {
109   return GetRangeConstraint((is_in_upper_bound ? 0 : RANGE_OVERFLOW) |
110                             (is_in_lower_bound ? 0 : RANGE_UNDERFLOW));
111 }
112 
113 template <
114     typename Dst,
115     typename Src,
116     IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed
117                                             ? INTEGER_REPRESENTATION_SIGNED
118                                             : INTEGER_REPRESENTATION_UNSIGNED,
119     IntegerRepresentation SrcSign = std::numeric_limits<Src>::is_signed
120                                             ? INTEGER_REPRESENTATION_SIGNED
121                                             : INTEGER_REPRESENTATION_UNSIGNED,
122     NumericRangeRepresentation DstRange =
123         StaticDstRangeRelationToSrcRange<Dst, Src>::value >
124 struct DstRangeRelationToSrcRangeImpl;
125 
126 // The following templates are for ranges that must be verified at runtime. We
127 // split it into checks based on signedness to avoid confusing casts and
128 // compiler warnings on signed an unsigned comparisons.
129 
130 // Dst range is statically determined to contain Src: Nothing to check.
131 template <typename Dst,
132           typename Src,
133           IntegerRepresentation DstSign,
134           IntegerRepresentation SrcSign>
135 struct DstRangeRelationToSrcRangeImpl<Dst,
136                                       Src,
137                                       DstSign,
138                                       SrcSign,
139                                       NUMERIC_RANGE_CONTAINED> {
140   static RangeConstraint Check(Src value) { return RANGE_VALID; }
141 };
142 
143 // Signed to signed narrowing: Both the upper and lower boundaries may be
144 // exceeded.
145 template <typename Dst, typename Src>
146 struct DstRangeRelationToSrcRangeImpl<Dst,
147                                       Src,
148                                       INTEGER_REPRESENTATION_SIGNED,
149                                       INTEGER_REPRESENTATION_SIGNED,
150                                       NUMERIC_RANGE_NOT_CONTAINED> {
151   static RangeConstraint Check(Src value) {
152     return std::numeric_limits<Dst>::is_iec559
153                ? GetRangeConstraint(value <= std::numeric_limits<Dst>::max(),
154                                     value >= -std::numeric_limits<Dst>::max())
155                : GetRangeConstraint(value <= std::numeric_limits<Dst>::max(),
156                                     value >= std::numeric_limits<Dst>::min());
157   }
158 };
159 
160 // Unsigned to unsigned narrowing: Only the upper boundary can be exceeded.
161 template <typename Dst, typename Src>
162 struct DstRangeRelationToSrcRangeImpl<Dst,
163                                       Src,
164                                       INTEGER_REPRESENTATION_UNSIGNED,
165                                       INTEGER_REPRESENTATION_UNSIGNED,
166                                       NUMERIC_RANGE_NOT_CONTAINED> {
167   static RangeConstraint Check(Src value) {
168     return GetRangeConstraint(value <= std::numeric_limits<Dst>::max(), true);
169   }
170 };
171 
172 // Unsigned to signed: The upper boundary may be exceeded.
173 template <typename Dst, typename Src>
174 struct DstRangeRelationToSrcRangeImpl<Dst,
175                                       Src,
176                                       INTEGER_REPRESENTATION_SIGNED,
177                                       INTEGER_REPRESENTATION_UNSIGNED,
178                                       NUMERIC_RANGE_NOT_CONTAINED> {
179   static RangeConstraint Check(Src value) {
180     return sizeof(Dst) > sizeof(Src)
181                ? RANGE_VALID
182                : GetRangeConstraint(
183                      value <= static_cast<Src>(std::numeric_limits<Dst>::max()),
184                      true);
185   }
186 };
187 
188 // Signed to unsigned: The upper boundary may be exceeded for a narrower Dst,
189 // and any negative value exceeds the lower boundary.
190 template <typename Dst, typename Src>
191 struct DstRangeRelationToSrcRangeImpl<Dst,
192                                       Src,
193                                       INTEGER_REPRESENTATION_UNSIGNED,
194                                       INTEGER_REPRESENTATION_SIGNED,
195                                       NUMERIC_RANGE_NOT_CONTAINED> {
196   static RangeConstraint Check(Src value) {
197     return (MaxExponent<Dst>::value >= MaxExponent<Src>::value)
198                ? GetRangeConstraint(true, value >= static_cast<Src>(0))
199                : GetRangeConstraint(
200                      value <= static_cast<Src>(std::numeric_limits<Dst>::max()),
201                      value >= static_cast<Src>(0));
202   }
203 };
204 
205 template <typename Dst, typename Src>
206 inline RangeConstraint DstRangeRelationToSrcRange(Src value) {
207   COMPILE_ASSERT(std::numeric_limits<Src>::is_specialized,
208                  argument_must_be_numeric);
209   COMPILE_ASSERT(std::numeric_limits<Dst>::is_specialized,
210                  result_must_be_numeric);
211   return DstRangeRelationToSrcRangeImpl<Dst, Src>::Check(value);
212 }
213 
214 }  // namespace internal
215 }  // namespace base
216 }  // namespace pdfium
217 
218 #endif  // PDFIUM_THIRD_PARTY_BASE_SAFE_CONVERSIONS_IMPL_H_
219