Provide overflow safe integer math inline functions.
It's not easy to get signed integer overflow checks correct and fast. Therefore abstract the necessary infrastructure into a common header providing addition, subtraction and multiplication for 16, 32, 64 bit signed integers. The new macros aren't yet used, but a followup commit will convert several open coded overflow checks. Author: Andres Freund, with some code stolen from Greg Stark Reviewed-By: Robert Haas Discussion: https://postgr.es/m/20171024103954.ztmatprlglz3rwke@alap3.anarazel.de
This commit is contained in:
parent
95b52351fe
commit
4d6ad31257
|
@ -299,6 +299,28 @@ fi])# PGAC_C_BUILTIN_CONSTANT_P
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
# PGAC_C_BUILTIN_OP_OVERFLOW
|
||||||
|
# -------------------------
|
||||||
|
# Check if the C compiler understands __builtin_$op_overflow(),
|
||||||
|
# and define HAVE__BUILTIN_OP_OVERFLOW if so.
|
||||||
|
#
|
||||||
|
# Check for the most complicated case, 64 bit multiplication, as a
|
||||||
|
# proxy for all of the operations.
|
||||||
|
AC_DEFUN([PGAC_C_BUILTIN_OP_OVERFLOW],
|
||||||
|
[AC_CACHE_CHECK(for __builtin_mul_overflow, pgac_cv__builtin_op_overflow,
|
||||||
|
[AC_COMPILE_IFELSE([AC_LANG_PROGRAM([],
|
||||||
|
[PG_INT64_TYPE result;
|
||||||
|
__builtin_mul_overflow((PG_INT64_TYPE) 1, (PG_INT64_TYPE) 2, &result);]
|
||||||
|
)],
|
||||||
|
[pgac_cv__builtin_op_overflow=yes],
|
||||||
|
[pgac_cv__builtin_op_overflow=no])])
|
||||||
|
if test x"$pgac_cv__builtin_op_overflow" = xyes ; then
|
||||||
|
AC_DEFINE(HAVE__BUILTIN_OP_OVERFLOW, 1,
|
||||||
|
[Define to 1 if your compiler understands __builtin_$op_overflow.])
|
||||||
|
fi])# PGAC_C_BUILTIN_OP_OVERFLOW
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# PGAC_C_BUILTIN_UNREACHABLE
|
# PGAC_C_BUILTIN_UNREACHABLE
|
||||||
# --------------------------
|
# --------------------------
|
||||||
# Check if the C compiler understands __builtin_unreachable(),
|
# Check if the C compiler understands __builtin_unreachable(),
|
||||||
|
|
|
@ -14472,6 +14472,39 @@ esac
|
||||||
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for __builtin_mul_overflow" >&5
|
||||||
|
$as_echo_n "checking for __builtin_mul_overflow... " >&6; }
|
||||||
|
if ${pgac_cv__builtin_op_overflow+:} false; then :
|
||||||
|
$as_echo_n "(cached) " >&6
|
||||||
|
else
|
||||||
|
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
|
||||||
|
/* end confdefs.h. */
|
||||||
|
|
||||||
|
int
|
||||||
|
main ()
|
||||||
|
{
|
||||||
|
PG_INT64_TYPE result;
|
||||||
|
__builtin_mul_overflow((PG_INT64_TYPE) 1, (PG_INT64_TYPE) 2, &result);
|
||||||
|
|
||||||
|
;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
_ACEOF
|
||||||
|
if ac_fn_c_try_compile "$LINENO"; then :
|
||||||
|
pgac_cv__builtin_op_overflow=yes
|
||||||
|
else
|
||||||
|
pgac_cv__builtin_op_overflow=no
|
||||||
|
fi
|
||||||
|
rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
|
||||||
|
fi
|
||||||
|
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $pgac_cv__builtin_op_overflow" >&5
|
||||||
|
$as_echo "$pgac_cv__builtin_op_overflow" >&6; }
|
||||||
|
if test x"$pgac_cv__builtin_op_overflow" = xyes ; then
|
||||||
|
|
||||||
|
$as_echo "#define HAVE__BUILTIN_OP_OVERFLOW 1" >>confdefs.h
|
||||||
|
|
||||||
|
fi
|
||||||
|
|
||||||
# Check size of void *, size_t (enables tweaks for > 32bit address space)
|
# Check size of void *, size_t (enables tweaks for > 32bit address space)
|
||||||
# The cast to long int works around a bug in the HP C Compiler
|
# The cast to long int works around a bug in the HP C Compiler
|
||||||
# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
|
# version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
|
||||||
|
|
|
@ -1770,6 +1770,10 @@ if test $pgac_need_repl_snprintf = yes; then
|
||||||
AC_LIBOBJ(snprintf)
|
AC_LIBOBJ(snprintf)
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# has to be down here, rather than with the other builtins, because
|
||||||
|
# the test uses PG_INT64_TYPE.
|
||||||
|
PGAC_C_BUILTIN_OP_OVERFLOW
|
||||||
|
|
||||||
# Check size of void *, size_t (enables tweaks for > 32bit address space)
|
# Check size of void *, size_t (enables tweaks for > 32bit address space)
|
||||||
AC_CHECK_SIZEOF([void *])
|
AC_CHECK_SIZEOF([void *])
|
||||||
AC_CHECK_SIZEOF([size_t])
|
AC_CHECK_SIZEOF([size_t])
|
||||||
|
|
|
@ -0,0 +1,239 @@
|
||||||
|
/*-------------------------------------------------------------------------
|
||||||
|
*
|
||||||
|
* int.h
|
||||||
|
* Routines to perform integer math, while checking for overflows.
|
||||||
|
*
|
||||||
|
* The routines in this file are intended to be well defined C, without
|
||||||
|
* relying on compiler flags like -fwrapv.
|
||||||
|
*
|
||||||
|
* To reduce the overhead of these routines try to use compiler intrinsics
|
||||||
|
* where available. That's not that important for the 16, 32 bit cases, but
|
||||||
|
* the 64 bit cases can be considerably faster with intrinsics. In case no
|
||||||
|
* intrinsics are available 128 bit math is used where available.
|
||||||
|
*
|
||||||
|
* Copyright (c) 2017, PostgreSQL Global Development Group
|
||||||
|
*
|
||||||
|
* src/include/common/int.h
|
||||||
|
*
|
||||||
|
*-------------------------------------------------------------------------
|
||||||
|
*/
|
||||||
|
#ifndef COMMON_INT_H
|
||||||
|
#define COMMON_INT_H
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a + b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_add_s16_overflow(int16 a, int16 b, int16 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_add_overflow(a, b, result);
|
||||||
|
#else
|
||||||
|
int32 res = (int32) a + (int32) b;
|
||||||
|
|
||||||
|
if (res > PG_INT16_MAX || res < PG_INT16_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int16) res;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a - b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_sub_s16_overflow(int16 a, int16 b, int16 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_sub_overflow(a, b, result);
|
||||||
|
#else
|
||||||
|
int32 res = (int32) a - (int32) b;
|
||||||
|
|
||||||
|
if (res > PG_INT16_MAX || res < PG_INT16_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int16) res;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a * b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_mul_s16_overflow(int16 a, int16 b, int16 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_mul_overflow(a, b, result);
|
||||||
|
#else
|
||||||
|
int32 res = (int32) a * (int32) b;
|
||||||
|
|
||||||
|
if (res > PG_INT16_MAX || res < PG_INT16_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int16) res;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a + b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_add_s32_overflow(int32 a, int32 b, int32 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_add_overflow(a, b, result);
|
||||||
|
#else
|
||||||
|
int64 res = (int64) a + (int64) b;
|
||||||
|
|
||||||
|
if (res > PG_INT32_MAX || res < PG_INT32_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int32) res;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a - b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_sub_s32_overflow(int32 a, int32 b, int32 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_sub_overflow(a, b, result);
|
||||||
|
#else
|
||||||
|
int64 res = (int64) a - (int64) b;
|
||||||
|
|
||||||
|
if (res > PG_INT32_MAX || res < PG_INT32_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int32) res;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a * b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_mul_s32_overflow(int32 a, int32 b, int32 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_mul_overflow(a, b, result);
|
||||||
|
#else
|
||||||
|
int64 res = (int64) a * (int64) b;
|
||||||
|
|
||||||
|
if (res > PG_INT32_MAX || res < PG_INT32_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int32) res;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a + b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_add_s64_overflow(int64 a, int64 b, int64 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_add_overflow(a, b, result);
|
||||||
|
#elif defined(HAVE_INT128)
|
||||||
|
int128 res = (int128) a + (int128) b;
|
||||||
|
|
||||||
|
if (res > PG_INT64_MAX || res < PG_INT64_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int64) res;
|
||||||
|
return false;
|
||||||
|
#else
|
||||||
|
if ((a > 0 && b > 0 && a > PG_INT64_MAX - b) ||
|
||||||
|
(a < 0 && b < 0 && a < PG_INT64_MIN - b))
|
||||||
|
return true;
|
||||||
|
*result = a + b;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a - b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_sub_s64_overflow(int64 a, int64 b, int64 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_sub_overflow(a, b, result);
|
||||||
|
#elif defined(HAVE_INT128)
|
||||||
|
int128 res = (int128) a - (int128) b;
|
||||||
|
|
||||||
|
if (res > PG_INT64_MAX || res < PG_INT64_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int64) res;
|
||||||
|
return false;
|
||||||
|
#else
|
||||||
|
if ((a < 0 && b > 0 && a < PG_INT64_MIN + b) ||
|
||||||
|
(a > 0 && b < 0 && a > PG_INT64_MAX + b))
|
||||||
|
return true;
|
||||||
|
*result = a - b;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If a * b overflows, return true, otherwise store the result of a + b into
|
||||||
|
* *result. The content of *result is implementation defined in case of
|
||||||
|
* overflow.
|
||||||
|
*/
|
||||||
|
static inline bool
|
||||||
|
pg_mul_s64_overflow(int64 a, int64 b, int64 *result)
|
||||||
|
{
|
||||||
|
#if defined(HAVE__BUILTIN_OP_OVERFLOW)
|
||||||
|
return __builtin_mul_overflow(a, b, result);
|
||||||
|
#elif defined(HAVE_INT128)
|
||||||
|
int128 res = (int128) a * (int128) b;
|
||||||
|
|
||||||
|
if (res > PG_INT64_MAX || res < PG_INT64_MIN)
|
||||||
|
return true;
|
||||||
|
*result = (int64) res;
|
||||||
|
return false;
|
||||||
|
#else
|
||||||
|
/*
|
||||||
|
* Overflow can only happen if at least one value is outside the range
|
||||||
|
* sqrt(min)..sqrt(max) so check that first as the division can be quite a
|
||||||
|
* bit more expensive than the multiplication.
|
||||||
|
*
|
||||||
|
* Multiplying by 0 or 1 can't overflow of course and checking for 0
|
||||||
|
* separately avoids any risk of dividing by 0. Be careful about dividing
|
||||||
|
* INT_MIN by -1 also, note reversing the a and b to ensure we're always
|
||||||
|
* dividing it by a positive value.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
if ((a > PG_INT32_MAX || a < PG_INT32_MIN ||
|
||||||
|
b > PG_INT32_MAX || b < PG_INT32_MIN) &&
|
||||||
|
a != 0 && a != 1 && b != 0 && b != 1 &&
|
||||||
|
((a > 0 && b > 0 && a > PG_INT64_MAX / b) ||
|
||||||
|
(a > 0 && b < 0 && b < PG_INT64_MIN / a) ||
|
||||||
|
(a < 0 && b > 0 && a < PG_INT64_MIN / b) ||
|
||||||
|
(a < 0 && b < 0 && a < PG_INT64_MAX / b)))
|
||||||
|
{
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
*result = a * b;
|
||||||
|
return false;
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
#endif /* COMMON_INT_H */
|
|
@ -690,6 +690,9 @@
|
||||||
/* Define to 1 if your compiler understands __builtin_constant_p. */
|
/* Define to 1 if your compiler understands __builtin_constant_p. */
|
||||||
#undef HAVE__BUILTIN_CONSTANT_P
|
#undef HAVE__BUILTIN_CONSTANT_P
|
||||||
|
|
||||||
|
/* Define to 1 if your compiler understands __builtin_$op_overflow. */
|
||||||
|
#undef HAVE__BUILTIN_OP_OVERFLOW
|
||||||
|
|
||||||
/* Define to 1 if your compiler understands __builtin_types_compatible_p. */
|
/* Define to 1 if your compiler understands __builtin_types_compatible_p. */
|
||||||
#undef HAVE__BUILTIN_TYPES_COMPATIBLE_P
|
#undef HAVE__BUILTIN_TYPES_COMPATIBLE_P
|
||||||
|
|
||||||
|
|
|
@ -515,6 +515,9 @@
|
||||||
/* Define to 1 if your compiler understands __builtin_constant_p. */
|
/* Define to 1 if your compiler understands __builtin_constant_p. */
|
||||||
/* #undef HAVE__BUILTIN_CONSTANT_P */
|
/* #undef HAVE__BUILTIN_CONSTANT_P */
|
||||||
|
|
||||||
|
/* Define to 1 if your compiler understands __builtin_$op_overflow. */
|
||||||
|
/* #undef HAVE__BUILTIN_OP_OVERFLOW */
|
||||||
|
|
||||||
/* Define to 1 if your compiler understands __builtin_types_compatible_p. */
|
/* Define to 1 if your compiler understands __builtin_types_compatible_p. */
|
||||||
/* #undef HAVE__BUILTIN_TYPES_COMPATIBLE_P */
|
/* #undef HAVE__BUILTIN_TYPES_COMPATIBLE_P */
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue