MdePkg/BaseSafeIntLib: Add SafeIntLib class and instance
https://bugzilla.tianocore.org/show_bug.cgi?id=798 SafeIntLib provides helper functions to prevent integer overflow during type conversion, addition, subtraction, and multiplication. Conversion Functions ==================== * Converting from a signed type to an unsigned type of the same size, or vice-versa. * Converting to a smaller type that could possibly overflow. * Converting from a signed type to a larger unsigned type. Unsigned Addition, Subtraction, Multiplication =============================================== * Unsigned integer math functions protect from overflow and underflow (in case of subtraction). Signed Addition, Subtraction, Multiplication ============================================ * Strongly consider using unsigned numbers. * Signed numbers are often used where unsigned numbers should be used. For example file sizes and array indices should always be unsigned. Subtracting a larger positive signed number from a smaller positive signed number with SafeInt32Sub() will succeed, producing a negative number, that then must not be used as an array index (but can occasionally be used as a pointer index.) Similarly for adding a larger magnitude negative number to a smaller magnitude positive number. * SafeIntLib does not protect you from such errors. It tells you if your integer operations overflowed, not if you are doing the right thing with your non-overflowed integers. * Likewise you can overflow a buffer with a non-overflowed unsigned index. Based on content from the following branch/commits: https://github.com/Microsoft/MS_UEFI/tree/share/MsCapsuleSupport21ef3a321cca516b1a6133bab4031aCc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Sean Brogan <sean.brogan@microsoft.com> Reviewed-by: Liming Gao <liming.gao@intel.com>
This commit is contained in:
Sean Brogan
committed by
Kinney, Michael D
Kinney, Michael D
parent
11cf02f6d0
commit
d7a09cb86a
@@ -1,7 +1,7 @@
|
||||
/** @file
|
||||
Processor or Compiler specific defines and types for AArch64.
|
||||
|
||||
Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>
|
||||
Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>
|
||||
Portions copyright (c) 2011 - 2013, ARM Ltd. All rights reserved.<BR>
|
||||
|
||||
@@ -99,6 +99,11 @@ typedef INT64 INTN;
|
||||
#define MAX_INTN ((INTN)0x7FFFFFFFFFFFFFFFULL)
|
||||
#define MAX_UINTN ((UINTN)0xFFFFFFFFFFFFFFFFULL)
|
||||
|
||||
///
|
||||
/// Minimum legal AArch64 INTN value.
|
||||
///
|
||||
#define MIN_INTN (((INTN)-9223372036854775807LL) - 1)
|
||||
|
||||
///
|
||||
/// The stack alignment required for AARCH64
|
||||
///
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/** @file
|
||||
Processor or Compiler specific defines and types for ARM.
|
||||
|
||||
Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>
|
||||
Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>
|
||||
This program and the accompanying materials
|
||||
are licensed and made available under the terms and conditions of the BSD License
|
||||
@@ -105,6 +105,11 @@ typedef INT32 INTN;
|
||||
#define MAX_INTN ((INTN)0x7FFFFFFF)
|
||||
#define MAX_UINTN ((UINTN)0xFFFFFFFF)
|
||||
|
||||
///
|
||||
/// Minimum legal ARM INTN value.
|
||||
///
|
||||
#define MIN_INTN (((INTN)-2147483647) - 1)
|
||||
|
||||
///
|
||||
/// The stack alignment required for ARM
|
||||
///
|
||||
|
||||
@@ -396,6 +396,14 @@ struct _LIST_ENTRY {
|
||||
#define MAX_INT64 ((INT64)0x7FFFFFFFFFFFFFFFULL)
|
||||
#define MAX_UINT64 ((UINT64)0xFFFFFFFFFFFFFFFFULL)
|
||||
|
||||
///
|
||||
/// Minimum values for the signed UEFI Data Types
|
||||
///
|
||||
#define MIN_INT8 (((INT8) -127) - 1)
|
||||
#define MIN_INT16 (((INT16) -32767) - 1)
|
||||
#define MIN_INT32 (((INT32) -2147483647) - 1)
|
||||
#define MIN_INT64 (((INT64) -9223372036854775807LL) - 1)
|
||||
|
||||
#define BIT0 0x00000001
|
||||
#define BIT1 0x00000002
|
||||
#define BIT2 0x00000004
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
We currently only have one EBC compiler so there may be some Intel compiler
|
||||
specific functions in this file.
|
||||
|
||||
Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>
|
||||
This program and the accompanying materials are licensed and made available under
|
||||
the terms and conditions of the BSD License that accompanies this distribution.
|
||||
The full text of the license may be found at
|
||||
@@ -91,23 +91,28 @@ typedef unsigned long UINTN;
|
||||
/// A value of native width with the highest bit set.
|
||||
/// Scalable macro to set the most significant bit in a natural number.
|
||||
///
|
||||
#define MAX_BIT (1ULL << (sizeof (INTN) * 8 - 1))
|
||||
#define MAX_BIT ((UINTN)((1ULL << (sizeof (INTN) * 8 - 1))))
|
||||
///
|
||||
/// A value of native width with the two highest bits set.
|
||||
/// Scalable macro to set the most 2 significant bits in a natural number.
|
||||
///
|
||||
#define MAX_2_BITS (3ULL << (sizeof (INTN) * 8 - 2))
|
||||
#define MAX_2_BITS ((UINTN)(3ULL << (sizeof (INTN) * 8 - 2)))
|
||||
|
||||
///
|
||||
/// Maximum legal EBC address
|
||||
///
|
||||
#define MAX_ADDRESS ((UINTN) ~0)
|
||||
#define MAX_ADDRESS ((UINTN)(~0ULL >> (64 - sizeof (INTN) * 8)))
|
||||
|
||||
///
|
||||
/// Maximum legal EBC INTN and UINTN values.
|
||||
///
|
||||
#define MAX_UINTN ((UINTN) ~0)
|
||||
#define MAX_INTN ((INTN)~MAX_BIT)
|
||||
#define MAX_UINTN ((UINTN)(~0ULL >> (64 - sizeof (INTN) * 8)))
|
||||
#define MAX_INTN ((INTN)(~0ULL >> (65 - sizeof (INTN) * 8)))
|
||||
|
||||
///
|
||||
/// Minimum legal EBC INTN value.
|
||||
///
|
||||
#define MIN_INTN (((INTN)-MAX_INTN) - 1)
|
||||
|
||||
///
|
||||
/// The stack alignment required for EBC
|
||||
|
||||
@@ -252,6 +252,11 @@ typedef INT32 INTN;
|
||||
#define MAX_INTN ((INTN)0x7FFFFFFF)
|
||||
#define MAX_UINTN ((UINTN)0xFFFFFFFF)
|
||||
|
||||
///
|
||||
/// Minimum legal IA-32 INTN value.
|
||||
///
|
||||
#define MIN_INTN (((INTN)-2147483647) - 1)
|
||||
|
||||
///
|
||||
/// The stack alignment required for IA-32.
|
||||
///
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/** @file
|
||||
Processor or Compiler specific defines and types for Intel Itanium(TM) processors.
|
||||
|
||||
Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>
|
||||
This program and the accompanying materials are licensed and made available
|
||||
under the terms and conditions of the BSD License which accompanies this
|
||||
distribution. The full text of the license may be found at
|
||||
@@ -242,6 +242,11 @@ typedef INT64 INTN;
|
||||
#define MAX_INTN ((INTN)0x7FFFFFFFFFFFFFFFULL)
|
||||
#define MAX_UINTN ((UINTN)0xFFFFFFFFFFFFFFFFULL)
|
||||
|
||||
///
|
||||
/// Minimum legal Itanium-based INTN value.
|
||||
///
|
||||
#define MIN_INTN (((INTN)-9223372036854775807LL) - 1)
|
||||
|
||||
///
|
||||
/// Per the Itanium Software Conventions and Runtime Architecture Guide,
|
||||
/// section 3.3.4, IPF stack must always be 16-byte aligned.
|
||||
|
||||
3030
MdePkg/Include/Library/SafeIntLib.h
Normal file
3030
MdePkg/Include/Library/SafeIntLib.h
Normal file
File diff suppressed because it is too large
Load Diff
@@ -266,6 +266,11 @@ typedef INT64 INTN;
|
||||
#define MAX_INTN ((INTN)0x7FFFFFFFFFFFFFFFULL)
|
||||
#define MAX_UINTN ((UINTN)0xFFFFFFFFFFFFFFFFULL)
|
||||
|
||||
///
|
||||
/// Minimum legal x64 INTN value.
|
||||
///
|
||||
#define MIN_INTN (((INTN)-9223372036854775807LL) - 1)
|
||||
|
||||
///
|
||||
/// The stack alignment required for x64
|
||||
///
|
||||
|
||||
Reference in New Issue
Block a user