[PSDK]
[reactos.git] / reactos / include / psdk / intsafe.h
1 /*!
2 * \file intsafe.h
3 *
4 * \brief Windows helper functions for integer overflow prevention
5 *
6 * \package This file is part of the ReactOS PSDK package.
7 *
8 * \author
9 * Timo Kreuzer (timo.kreuzer@reactos.org)
10 *
11 * \copyright THIS SOFTWARE IS NOT COPYRIGHTED
12 *
13 * This source code is offered for use in the public domain. You may
14 * use, modify or distribute it freely.
15 *
16 * This code is distributed in the hope that it will be useful but
17 * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
18 * DISCLAIMED. This includes but is not limited to warranties of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * \todo
22 * - missing conversion functions
23 * - multiplication functions
24 * - signed add, sub and multiply functions
25 */
26 #pragma once
27
28 #ifndef _INTSAFE_H_INCLUDED_
29 #define _INTSAFE_H_INCLUDED_
30
31 #include <specstrings.h>
32
33 #if defined(__GNUC__) && !defined(__forceinline)
34 # if ( __MINGW_GNUC_PREREQ(4, 3) && __STDC_VERSION__ >= 199901L)
35 # define __forceinline extern inline __attribute__((__always_inline__,__gnu_inline__))
36 # else
37 # define __forceinline extern __inline__ __attribute__((__always_inline__))
38 # endif
39 #endif
40
41 /* Handle ntintsafe here too */
42 #ifdef _NTINTSAFE_H_INCLUDED_
43 #ifndef _NTDEF_ /* Guard agains redefinition from ntstatus.h */
44 typedef _Return_type_success_(return >= 0) long NTSTATUS;
45 #endif
46 #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
47 #define STATUS_SUCCESS ((NTSTATUS)0x00000000)
48 #define STATUS_INTEGER_OVERFLOW ((NTSTATUS)0xC0000095)
49 #define INTSAFE_RESULT NTSTATUS
50 #define INTSAFE_SUCCESS STATUS_SUCCESS
51 #define INTSAFE_E_ARITHMETIC_OVERFLOW STATUS_INTEGER_OVERFLOW
52 #define INTSAFE_NAME(name) Rtl##name
53 #else // _NTINTSAFE_H_INCLUDED_
54 #ifndef _HRESULT_DEFINED
55 typedef _Return_type_success_(return >= 0) long HRESULT;
56 #endif
57 #define SUCCEEDED(hr) (((HRESULT)(hr)) >= 0)
58 #define FAILED(hr) (((HRESULT)(hr)) < 0)
59 #define S_OK ((HRESULT)0L)
60 #define INTSAFE_RESULT HRESULT
61 #define INTSAFE_SUCCESS S_OK
62 #define INTSAFE_E_ARITHMETIC_OVERFLOW ((HRESULT)0x80070216L)
63 #define INTSAFE_NAME(name) name
64 #endif // _NTINTSAFE_H_INCLUDED_
65
66 #if !defined(_W64)
67 #if defined(_MSC_VER) && !defined(__midl) && (defined(_M_IX86) || defined(_M_ARM))
68 #define _W64 __w64
69 #else
70 #define _W64
71 #endif
72 #endif
73
74 /* Static assert */
75 #ifndef C_ASSERT
76 #ifdef _MSC_VER
77 # define C_ASSERT(e) typedef char __C_ASSERT__[(e)?1:-1]
78 #else
79 # define C_ASSERT(e) extern void __C_ASSERT__(int [(e)?1:-1])
80 #endif
81 #endif /* C_ASSERT */
82
83 /* Typedefs */
84 #ifndef _WINNT_
85 #ifndef _NTDEF_
86 typedef char CHAR;
87 typedef unsigned char UCHAR, UINT8;
88 typedef signed char INT8;
89 typedef short SHORT;
90 typedef signed short INT16;
91 typedef unsigned short USHORT, UINT16;
92 typedef int INT;
93 typedef unsigned int UINT32;
94 typedef signed int INT32;
95 typedef long LONG;
96 typedef unsigned long ULONG;
97 typedef long long LONGLONG, LONG64;
98 typedef signed long long INT64;
99 typedef unsigned long long ULONGLONG, DWORDLONG, ULONG64, DWORD64, UINT64;
100 #ifdef _WIN64
101 typedef long long INT_PTR, LONG_PTR, SSIZE_T, ptrdiff_t;
102 typedef unsigned long long UINT_PTR, ULONG_PTR, DWORD_PTR, SIZE_T, size_t;
103 #else // _WIN64
104 typedef _W64 int INT_PTR, ptrdiff_t;
105 typedef _W64 unsigned int UINT_PTR, size_t;
106 typedef _W64 long LONG_PTR, SSIZE_T;
107 typedef _W64 unsigned long ULONG_PTR, DWORD_PTR, SIZE_T;
108 #endif // _WIN64
109 #endif
110 typedef unsigned char BYTE;
111 typedef unsigned short WORD;
112 typedef unsigned int UINT;
113 typedef unsigned long DWORD;
114 #endif // _WINNT_
115
116 /* Just to be sure! */
117 C_ASSERT(sizeof(USHORT) == 2);
118 C_ASSERT(sizeof(INT) == 4);
119 C_ASSERT(sizeof(UINT) == 4);
120 C_ASSERT(sizeof(LONG) == 4);
121 C_ASSERT(sizeof(ULONG) == 4);
122 C_ASSERT(sizeof(DWORD) == 4);
123 C_ASSERT(sizeof(UINT_PTR) == sizeof(ULONG_PTR));
124
125 /* Integer range margins (use (x-1) to prevent warnings) */
126 #define INT8_MIN ((signed char)(-127 - 1))
127 #define SHORT_MIN (-32768)
128 #define INT16_MIN ((short)(-32767 - 1))
129 #define INT_MIN (-2147483647 - 1)
130 #define INT32_MIN (-2147483647 - 1)
131 #define LONG_MIN (-2147483647L - 1)
132 #define LONGLONG_MIN (-9223372036854775807LL - 1)
133 #define LONG64_MIN (-9223372036854775807LL - 1)
134 #define INT64_MIN (-9223372036854775807LL - 1)
135 #define INT128_MIN (-170141183460469231731687303715884105727i128 - 1)
136 #ifdef _WIN64
137 #define INT_PTR_MIN (-9223372036854775807LL - 1)
138 #define LONG_PTR_MIN (-9223372036854775807LL - 1)
139 #define PTRDIFF_T_MIN (-9223372036854775807LL - 1)
140 #define SSIZE_T_MIN (-9223372036854775807LL - 1)
141 #else /* _WIN64 */
142 #define INT_PTR_MIN (-2147483647 - 1)
143 #define LONG_PTR_MIN (-2147483647L - 1)
144 #define PTRDIFF_T_MIN (-2147483647 - 1)
145 #define SSIZE_T_MIN (-2147483647L - 1)
146 #endif /* _WIN64 */
147
148 #define INT8_MAX ((signed char)127)
149 #define UINT8_MAX ((unsigned char)0xffU)
150 #define BYTE_MAX ((unsigned char)0xff)
151 #define SHORT_MAX ((short)32767)
152 #define INT16_MAX ((short)32767)
153 #define USHORT_MAX ((unsigned short)0xffff)
154 #define UINT16_MAX ((unsigned short)0xffff)
155 #define WORD_MAX ((unsigned short)0xffff)
156 #define INT_MAX 2147483647
157 #define INT32_MAX 2147483647
158 #define UINT_MAX 0xffffffff
159 #define UINT32_MAX 0xffffffffU
160 #define LONG_MAX 2147483647L
161 #define ULONG_MAX 0xffffffffUL
162 #define DWORD_MAX 0xffffffffUL
163 #define LONGLONG_MAX 9223372036854775807LL
164 #define LONG64_MAX 9223372036854775807LL
165 #define INT64_MAX 9223372036854775807LL
166 #define ULONGLONG_MAX 0xffffffffffffffffULL
167 #define DWORDLONG_MAX 0xffffffffffffffffULL
168 #define ULONG64_MAX 0xffffffffffffffffULL
169 #define DWORD64_MAX 0xffffffffffffffffULL
170 #define UINT64_MAX 0xffffffffffffffffULL
171 #define INT128_MAX 170141183460469231731687303715884105727i128
172 #define UINT128_MAX 0xffffffffffffffffffffffffffffffffui128
173 #undef SIZE_T_MAX
174 #ifdef _WIN64
175 #define INT_PTR_MAX 9223372036854775807LL
176 #define UINT_PTR_MAX 0xffffffffffffffffULL
177 #define LONG_PTR_MAX 9223372036854775807LL
178 #define ULONG_PTR_MAX 0xffffffffffffffffULL
179 #define DWORD_PTR_MAX 0xffffffffffffffffULL
180 #define PTRDIFF_T_MAX 9223372036854775807LL
181 #define SIZE_T_MAX 0xffffffffffffffffULL
182 #define SSIZE_T_MAX 9223372036854775807LL
183 #define _SIZE_T_MAX 0xffffffffffffffffULL
184 #else /* _WIN64 */
185 #define INT_PTR_MAX 2147483647
186 #define UINT_PTR_MAX 0xffffffff
187 #define LONG_PTR_MAX 2147483647L
188 #define ULONG_PTR_MAX 0xffffffffUL
189 #define DWORD_PTR_MAX 0xffffffffUL
190 #define PTRDIFF_T_MAX 2147483647
191 #define SIZE_T_MAX 0xffffffff
192 #define SSIZE_T_MAX 2147483647L
193 #define _SIZE_T_MAX 0xffffffffUL
194 #endif /* _WIN64 */
195
196 /* Error values */
197 #define INT8_ERROR ((signed char)(-1))
198 #define UINT8_ERROR ((unsigned char)0xff)
199 #define BYTE_ERROR ((unsigned char)0xff)
200 #define SHORT_ERROR ((short)(-1))
201 #define INT16_ERROR ((short)(-1))
202 #define USHORT_ERROR ((unsigned short)0xffff)
203 #define UINT16_ERROR ((unsigned short)0xffff)
204 #define WORD_ERROR ((unsigned short)0xffff)
205 #define INT_ERROR (-1)
206 #define INT32_ERROR (-1)
207 #define UINT_ERROR 0xffffffffU
208 #define UINT32_ERROR 0xffffffffU
209 #define LONG_ERROR (-1L)
210 #define ULONG_ERROR 0xffffffffUL
211 #define DWORD_ERROR 0xffffffffUL
212 #define LONGLONG_ERROR (-1LL)
213 #define LONG64_ERROR (-1LL)
214 #define INT64_ERROR (-1LL)
215 #define ULONGLONG_ERROR 0xffffffffffffffffULL
216 #define DWORDLONG_ERROR 0xffffffffffffffffULL
217 #define ULONG64_ERROR 0xffffffffffffffffULL
218 #define UINT64_ERROR 0xffffffffffffffffULL
219 #ifdef _WIN64
220 #define INT_PTR_ERROR (-1LL)
221 #define UINT_PTR_ERROR 0xffffffffffffffffULL
222 #define LONG_PTR_ERROR (-1LL)
223 #define ULONG_PTR_ERROR 0xffffffffffffffffULL
224 #define DWORD_PTR_ERROR 0xffffffffffffffffULL
225 #define PTRDIFF_T_ERROR (-1LL)
226 #define SIZE_T_ERROR 0xffffffffffffffffULL
227 #define SSIZE_T_ERROR (-1LL)
228 #define _SIZE_T_ERROR 0xffffffffffffffffULL
229 #else /* _WIN64 */
230 #define INT_PTR_ERROR (-1)
231 #define UINT_PTR_ERROR 0xffffffffU
232 #define LONG_PTR_ERROR (-1L)
233 #define ULONG_PTR_ERROR 0xffffffffUL
234 #define DWORD_PTR_ERROR 0xffffffffUL
235 #define PTRDIFF_T_ERROR (-1)
236 #define SIZE_T_ERROR 0xffffffffU
237 #define SSIZE_T_ERROR (-1L)
238 #define _SIZE_T_ERROR 0xffffffffUL
239 #endif /* _WIN64 */
240
241 /* special definitons (the CHAR ones should not be defined here!) */
242 #define _INTSAFE_CHAR CHAR
243 #define _INTSAFE_CHAR_ERROR ((signed char)(-1))
244 #ifdef _CHAR_UNSIGNED
245 #define _INTSAFE_CHAR_MIN ((unsigned char)0)
246 #define _INTSAFE_CHAR_MAX ((unsigned char)0xff)
247 #else
248 #define _INTSAFE_CHAR_MIN ((signed char)(-128))
249 #define _INTSAFE_CHAR_MAX ((signed char)127)
250 #endif /* _CHAR_UNSIGNED */
251
252 #define size_t_ERROR SIZE_T_ERROR
253 #define UCHAR_ERROR '\0'
254 #define CHAR_ERROR '\0'
255
256 /* 32 bit x 32 bit to 64 bit unsigned multiplication */
257 #ifndef UInt32x32To64
258 #define UInt32x32To64(a,b) ((unsigned __int64)(unsigned int)(a)*(unsigned __int64)(unsigned int)(b))
259 #endif
260
261 /* Convert unsigned to signed or unsigned */
262 #define DEFINE_SAFE_CONVERT_UTOX(_Name, _TypeFrom, _TypeTo) \
263 _Must_inspect_result_ \
264 __forceinline \
265 INTSAFE_RESULT \
266 INTSAFE_NAME(_Name)( \
267 _In_ _TypeFrom Input, \
268 _Out_ _Deref_out_range_(==, Input) _TypeTo *pOutput) \
269 { \
270 if (Input <= _TypeTo ## _MAX) \
271 { \
272 *pOutput = (_TypeTo)Input; \
273 return INTSAFE_SUCCESS; \
274 } \
275 else \
276 { \
277 *pOutput = _TypeTo ## _ERROR; \
278 return INTSAFE_E_ARITHMETIC_OVERFLOW; \
279 } \
280 }
281
282 DEFINE_SAFE_CONVERT_UTOX(ByteToChar, BYTE, _INTSAFE_CHAR)
283 DEFINE_SAFE_CONVERT_UTOX(ByteToInt8, BYTE, INT8)
284 DEFINE_SAFE_CONVERT_UTOX(UInt8ToChar, UINT8, _INTSAFE_CHAR)
285 DEFINE_SAFE_CONVERT_UTOX(UInt8ToInt8, UINT8, INT8)
286 DEFINE_SAFE_CONVERT_UTOX(UShortToChar, USHORT, _INTSAFE_CHAR)
287 DEFINE_SAFE_CONVERT_UTOX(UShortToUChar, USHORT, UINT8)
288 DEFINE_SAFE_CONVERT_UTOX(UShortToInt8, USHORT, INT8)
289 DEFINE_SAFE_CONVERT_UTOX(UShortToUInt8, USHORT, UINT8)
290 DEFINE_SAFE_CONVERT_UTOX(UShortToShort, USHORT, SHORT)
291 DEFINE_SAFE_CONVERT_UTOX(UIntToUChar, UINT, UINT8)
292 DEFINE_SAFE_CONVERT_UTOX(UIntToInt8, UINT, INT8)
293 DEFINE_SAFE_CONVERT_UTOX(UIntToUInt8, UINT, UINT8)
294 DEFINE_SAFE_CONVERT_UTOX(UIntToShort, UINT, SHORT)
295 DEFINE_SAFE_CONVERT_UTOX(UIntToUShort, UINT, USHORT)
296 DEFINE_SAFE_CONVERT_UTOX(UIntToInt, UINT, INT)
297 DEFINE_SAFE_CONVERT_UTOX(UIntToLong, UINT, LONG)
298 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToUChar, UINT_PTR, UINT8)
299 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToInt8, UINT_PTR, INT8)
300 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToUInt8, UINT_PTR, UINT8)
301 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToShort, UINT_PTR, SHORT)
302 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToUShort, UINT_PTR, USHORT)
303 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToInt16, UINT_PTR, INT16)
304 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToUInt16, UINT_PTR, UINT16)
305 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToInt, UINT_PTR, INT)
306 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToLong, UINT_PTR, LONG)
307 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToIntPtr, UINT_PTR, INT_PTR)
308 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToLongPtr, UINT_PTR, LONG_PTR)
309 DEFINE_SAFE_CONVERT_UTOX(ULongToUChar, ULONG, UINT8)
310 DEFINE_SAFE_CONVERT_UTOX(ULongToUInt8, ULONG, UINT8)
311 DEFINE_SAFE_CONVERT_UTOX(ULongToShort, ULONG, SHORT)
312 DEFINE_SAFE_CONVERT_UTOX(ULongToUShort, ULONG, USHORT)
313 DEFINE_SAFE_CONVERT_UTOX(ULongToInt, ULONG, INT)
314 DEFINE_SAFE_CONVERT_UTOX(ULongToUInt, ULONG, UINT)
315 DEFINE_SAFE_CONVERT_UTOX(ULongToIntPtr, ULONG, INT_PTR)
316 DEFINE_SAFE_CONVERT_UTOX(ULongToUIntPtr, ULONG, UINT_PTR)
317 DEFINE_SAFE_CONVERT_UTOX(ULongToLongPtr, ULONG, LONG_PTR)
318 DEFINE_SAFE_CONVERT_UTOX(ULongPtrToULong, ULONG_PTR, ULONG)
319 DEFINE_SAFE_CONVERT_UTOX(ULongLongToUInt, ULONGLONG, UINT)
320 DEFINE_SAFE_CONVERT_UTOX(ULongLongToULong, ULONGLONG, ULONG)
321 DEFINE_SAFE_CONVERT_UTOX(ULongLongToULongPtr, ULONGLONG, ULONG_PTR)
322
323
324 /* Convert signed to unsigned */
325 #define DEFINE_SAFE_CONVERT_STOU(_Name, _TypeFrom, _TypeTo) \
326 _Must_inspect_result_ \
327 __forceinline \
328 INTSAFE_RESULT \
329 INTSAFE_NAME(_Name)( \
330 _In_ _TypeFrom Input, \
331 _Out_ _Deref_out_range_(==, Input) _TypeTo *pOutput) \
332 { \
333 if ((Input >= 0) && \
334 ((sizeof(_TypeFrom) <= sizeof(_TypeTo)) || (Input <= (_TypeFrom)_TypeTo ## _MAX))) \
335 { \
336 *pOutput = (_TypeTo)Input; \
337 return INTSAFE_SUCCESS; \
338 } \
339 else \
340 { \
341 *pOutput = _TypeTo ## _ERROR; \
342 return INTSAFE_E_ARITHMETIC_OVERFLOW; \
343 } \
344 }
345
346 DEFINE_SAFE_CONVERT_STOU(Int8ToUChar, INT8, UINT8)
347 DEFINE_SAFE_CONVERT_STOU(Int8ToUInt8, INT8, UINT8)
348 DEFINE_SAFE_CONVERT_STOU(Int8ToUShort, INT8, USHORT)
349 DEFINE_SAFE_CONVERT_STOU(Int8ToUInt, INT8, UINT)
350 DEFINE_SAFE_CONVERT_STOU(Int8ToULong, INT8, ULONG)
351 DEFINE_SAFE_CONVERT_STOU(Int8ToUIntPtr, INT8, UINT_PTR)
352 DEFINE_SAFE_CONVERT_STOU(Int8ToULongPtr, INT8, ULONG_PTR)
353 DEFINE_SAFE_CONVERT_STOU(Int8ToULongLong, INT8, ULONGLONG)
354 DEFINE_SAFE_CONVERT_STOU(ShortToUChar, SHORT, UINT8)
355 DEFINE_SAFE_CONVERT_STOU(ShortToUInt8, SHORT, UINT8)
356 DEFINE_SAFE_CONVERT_STOU(ShortToUShort, SHORT, USHORT)
357 DEFINE_SAFE_CONVERT_STOU(ShortToUInt, SHORT, UINT)
358 DEFINE_SAFE_CONVERT_STOU(ShortToULong, SHORT, ULONG)
359 DEFINE_SAFE_CONVERT_STOU(ShortToUIntPtr, SHORT, UINT_PTR)
360 DEFINE_SAFE_CONVERT_STOU(ShortToULongPtr, SHORT, ULONG_PTR)
361 DEFINE_SAFE_CONVERT_STOU(ShortToDWordPtr, SHORT, DWORD_PTR)
362 DEFINE_SAFE_CONVERT_STOU(ShortToULongLong, SHORT, ULONGLONG)
363 DEFINE_SAFE_CONVERT_STOU(IntToUChar, INT, UINT8)
364 DEFINE_SAFE_CONVERT_STOU(IntToUInt8, INT, UINT8)
365 DEFINE_SAFE_CONVERT_STOU(IntToUShort, INT, USHORT)
366 DEFINE_SAFE_CONVERT_STOU(IntToUInt, INT, UINT)
367 DEFINE_SAFE_CONVERT_STOU(IntToULong, INT, ULONG)
368 DEFINE_SAFE_CONVERT_STOU(IntToULongLong, INT, ULONGLONG)
369 DEFINE_SAFE_CONVERT_STOU(LongToUChar, LONG, UINT8)
370 DEFINE_SAFE_CONVERT_STOU(LongToUInt8, LONG, UINT8)
371 DEFINE_SAFE_CONVERT_STOU(LongToUShort, LONG, USHORT)
372 DEFINE_SAFE_CONVERT_STOU(LongToUInt, LONG, UINT)
373 DEFINE_SAFE_CONVERT_STOU(LongToULong, LONG, ULONG)
374 DEFINE_SAFE_CONVERT_STOU(LongToUIntPtr, LONG, UINT_PTR)
375 DEFINE_SAFE_CONVERT_STOU(LongToULongPtr, LONG, ULONG_PTR)
376 DEFINE_SAFE_CONVERT_STOU(LongToULongLong, LONG, ULONGLONG)
377 DEFINE_SAFE_CONVERT_STOU(IntPtrToUChar, INT_PTR, UINT8)
378 DEFINE_SAFE_CONVERT_STOU(IntPtrToUInt8, INT_PTR, UINT8)
379 DEFINE_SAFE_CONVERT_STOU(IntPtrToUShort, INT_PTR, USHORT)
380 DEFINE_SAFE_CONVERT_STOU(IntPtrToUInt, INT_PTR, UINT)
381 DEFINE_SAFE_CONVERT_STOU(IntPtrToULong, INT_PTR, ULONG)
382 DEFINE_SAFE_CONVERT_STOU(IntPtrToUIntPtr, INT_PTR, UINT_PTR)
383 DEFINE_SAFE_CONVERT_STOU(IntPtrToULongPtr, INT_PTR, ULONG_PTR)
384 DEFINE_SAFE_CONVERT_STOU(IntPtrToULongLong, INT_PTR, ULONGLONG)
385 DEFINE_SAFE_CONVERT_STOU(LongPtrToUChar, LONG_PTR, UINT8)
386 DEFINE_SAFE_CONVERT_STOU(LongPtrToUInt8, LONG_PTR, UINT8)
387 DEFINE_SAFE_CONVERT_STOU(LongPtrToUShort, LONG_PTR, USHORT)
388 DEFINE_SAFE_CONVERT_STOU(LongPtrToUInt, LONG_PTR, UINT)
389 DEFINE_SAFE_CONVERT_STOU(LongPtrToULong, LONG_PTR, ULONG)
390 DEFINE_SAFE_CONVERT_STOU(LongPtrToUIntPtr, LONG_PTR, UINT_PTR)
391 DEFINE_SAFE_CONVERT_STOU(LongPtrToULongPtr, LONG_PTR, ULONG_PTR)
392 DEFINE_SAFE_CONVERT_STOU(LongPtrToULongLong, LONG_PTR, ULONGLONG)
393 #ifdef _CHAR_UNSIGNED
394 DEFINE_SAFE_CONVERT_STOU(ShortToChar, SHORT, UINT8)
395 DEFINE_SAFE_CONVERT_STOU(LongPtrToChar, LONG_PTR, UINT8)
396 #endif
397
398
399 /* Convert signed to signed */
400 #define DEFINE_SAFE_CONVERT_STOS(_Name, _TypeFrom, _TypeTo) \
401 _Must_inspect_result_ \
402 __forceinline \
403 INTSAFE_RESULT \
404 INTSAFE_NAME(_Name)( \
405 _In_ _TypeFrom Input, \
406 _Out_ _Deref_out_range_(==, Input) _TypeTo *pOutput) \
407 { \
408 if ((Input >= _TypeTo ## _MIN) && (Input <= _TypeTo ## _MAX)) \
409 { \
410 *pOutput = (_TypeTo)Input; \
411 return INTSAFE_SUCCESS; \
412 } \
413 else \
414 { \
415 *pOutput = _TypeTo ## _ERROR; \
416 return INTSAFE_E_ARITHMETIC_OVERFLOW; \
417 } \
418 }
419
420 DEFINE_SAFE_CONVERT_STOS(ShortToInt8, SHORT, INT8)
421 DEFINE_SAFE_CONVERT_STOS(IntToInt8, INT, INT8)
422 DEFINE_SAFE_CONVERT_STOS(IntToShort, INT, SHORT)
423 DEFINE_SAFE_CONVERT_STOS(LongToInt8, LONG, INT8)
424 DEFINE_SAFE_CONVERT_STOS(LongToShort, LONG, SHORT)
425 DEFINE_SAFE_CONVERT_STOS(LongToInt, LONG, INT)
426 DEFINE_SAFE_CONVERT_STOS(IntPtrToInt8, INT_PTR, INT8)
427 DEFINE_SAFE_CONVERT_STOS(IntPtrToShort, INT_PTR, SHORT)
428 DEFINE_SAFE_CONVERT_STOS(IntPtrToInt, INT_PTR, INT)
429 DEFINE_SAFE_CONVERT_STOS(IntPtrToLong, INT_PTR, LONG)
430 DEFINE_SAFE_CONVERT_STOS(IntPtrToLongPtr, INT_PTR, LONG_PTR)
431 DEFINE_SAFE_CONVERT_STOS(LongPtrToInt8, LONG_PTR, INT8)
432 DEFINE_SAFE_CONVERT_STOS(LongPtrToShort, LONG_PTR, SHORT)
433 DEFINE_SAFE_CONVERT_STOS(LongPtrToInt, LONG_PTR, INT)
434 DEFINE_SAFE_CONVERT_STOS(LongPtrToLong, LONG_PTR, LONG)
435 DEFINE_SAFE_CONVERT_STOS(LongPtrToIntPtr, LONG_PTR, INT_PTR)
436 DEFINE_SAFE_CONVERT_STOS(LongLongToInt, LONGLONG, INT)
437 DEFINE_SAFE_CONVERT_STOS(LongLongToLong, LONGLONG, LONG)
438 DEFINE_SAFE_CONVERT_STOS(LongLongToIntPtr, LONGLONG, INT_PTR)
439 DEFINE_SAFE_CONVERT_STOS(LongLongToLongPtr, LONGLONG, LONG_PTR)
440 DEFINE_SAFE_CONVERT_STOS(ShortToChar, SHORT, _INTSAFE_CHAR)
441 DEFINE_SAFE_CONVERT_STOS(LongPtrToChar, LONG_PTR, _INTSAFE_CHAR)
442
443
444 #ifdef _NTINTSAFE_H_INCLUDED_
445
446 #define RtlInt8ToByte RtlInt8ToUInt8
447 #define RtlInt8ToUInt16 RtlInt8ToUShort
448 #define RtlInt8ToWord RtlInt8ToUShort
449 #define RtlInt8ToUInt32 RtlInt8ToUInt
450 #define RtlInt8ToDWord RtlInt8ToULong
451 #define RtlInt8ToDWordPtr RtlInt8ToULongPtr
452 #define RtlInt8ToDWordLong RtlInt8ToULongLong
453 #define RtlInt8ToULong64 RtlInt8ToULongLong
454 #define RtlInt8ToDWord64 RtlInt8ToULongLong
455 #define RtlInt8ToUInt64 RtlInt8ToULongLong
456 #define RtlInt8ToSizeT RtlInt8ToUIntPtr
457 #define RtlInt8ToSIZET RtlInt8ToULongPtr
458 #define RtlIntToSizeT RtlIntToUIntPtr
459 #define RtlIntToSIZET RtlIntToULongPtr
460 #define RtlULongToSSIZET RtlULongToLongPtr
461 #define RtlULongToByte RtlULongToUInt8
462 #define RtlULongLongToInt64 RtlULongLongToLongLong
463 #define RtlULongLongToLong64 RtlULongLongToLongLong
464 #define RtlULongLongToPtrdiffT RtlULongLongToIntPtr
465 #define RtlULongLongToSizeT RtlULongLongToUIntPtr
466 #define RtlULongLongToSSIZET RtlULongLongToLongPtr
467 #define RtlULongLongToSIZET RtlULongLongToULongPtr
468 #define RtlSIZETToULong RtlULongPtrToULong
469 #define RtlSSIZETToULongLong RtlLongPtrToULongLong
470 #define RtlSSIZETToULong RtlLongPtrToULong
471 #ifdef _WIN64
472 #define RtlIntToUIntPtr RtlIntToULongLong
473 #define RtlULongLongToIntPtr RtlULongLongToLongLong
474 #else
475 #define RtlIntToUIntPtr RtlIntToUInt
476 #define RtlULongLongToIntPtr RtlULongLongToInt
477 #define RtlULongLongToUIntPtr RtlULongLongToUInt
478 #define RtlULongLongToULongPtr RtlULongLongToULong
479 #endif
480
481 #else // _NTINTSAFE_H_INCLUDED_
482
483 #define Int8ToByte Int8ToUInt8
484 #define Int8ToUInt16 Int8ToUShort
485 #define Int8ToWord Int8ToUShort
486 #define Int8ToUInt32 Int8ToUInt
487 #define Int8ToDWord Int8ToULong
488 #define Int8ToDWordPtr Int8ToULongPtr
489 #define Int8ToDWordLong Int8ToULongLong
490 #define Int8ToULong64 Int8ToULongLong
491 #define Int8ToDWord64 Int8ToULongLong
492 #define Int8ToUInt64 Int8ToULongLong
493 #define Int8ToSizeT Int8ToUIntPtr
494 #define Int8ToSIZET Int8ToULongPtr
495 #define IntToSizeT IntToUIntPtr
496 #define IntToSIZET IntToULongPtr
497 #define ULongToSSIZET ULongToLongPtr
498 #define ULongToByte ULongToUInt8
499 #define ULongLongToInt64 ULongLongToLongLong
500 #define ULongLongToLong64 ULongLongToLongLong
501 #define ULongLongToPtrdiffT ULongLongToIntPtr
502 #define ULongLongToSizeT ULongLongToUIntPtr
503 #define ULongLongToSSIZET ULongLongToLongPtr
504 #define ULongLongToSIZET ULongLongToULongPtr
505 #define SIZETToULong ULongPtrToULong
506 #define SSIZETToULongLong LongPtrToULongLong
507 #define SSIZETToULong LongPtrToULong
508 #ifdef _WIN64
509 #define IntToUIntPtr IntToULongLong
510 #define ULongLongToIntPtr ULongLongToLongLong
511 #else
512 #define IntToUIntPtr IntToUInt
513 #define ULongLongToIntPtr ULongLongToInt
514 #define ULongLongToUIntPtr ULongLongToUInt
515 #define ULongLongToULongPtr ULongLongToULong
516 #endif
517
518 #endif // _NTINTSAFE_H_INCLUDED_
519
520
521 #define DEFINE_SAFE_ADD(_Name, _Type) \
522 _Must_inspect_result_ \
523 __forceinline \
524 INTSAFE_RESULT \
525 INTSAFE_NAME(_Name)( \
526 _In_ _Type Augend, \
527 _In_ _Type Addend, \
528 _Out_ _Deref_out_range_(==, Augend + Addend) _Type *pOutput) \
529 { \
530 if ((_Type)(Augend + Addend) >= Augend) \
531 { \
532 *pOutput = Augend + Addend; \
533 return INTSAFE_SUCCESS; \
534 } \
535 else \
536 { \
537 *pOutput = _Type ## _ERROR; \
538 return INTSAFE_E_ARITHMETIC_OVERFLOW; \
539 } \
540 }
541
542 DEFINE_SAFE_ADD(UInt8Add, UINT8)
543 DEFINE_SAFE_ADD(UShortAdd, USHORT)
544 DEFINE_SAFE_ADD(UIntAdd, UINT)
545 DEFINE_SAFE_ADD(ULongAdd, ULONG)
546 DEFINE_SAFE_ADD(UIntPtrAdd, UINT_PTR)
547 DEFINE_SAFE_ADD(ULongPtrAdd, ULONG_PTR)
548 DEFINE_SAFE_ADD(DWordPtrAdd, DWORD_PTR)
549 DEFINE_SAFE_ADD(SizeTAdd, size_t)
550 DEFINE_SAFE_ADD(SIZETAdd, SIZE_T)
551 DEFINE_SAFE_ADD(ULongLongAdd, ULONGLONG)
552
553
554 #define DEFINE_SAFE_SUB(_Name, _Type) \
555 _Must_inspect_result_ \
556 __forceinline \
557 INTSAFE_RESULT \
558 INTSAFE_NAME(_Name)( \
559 _In_ _Type Minuend, \
560 _In_ _Type Subtrahend, \
561 _Out_ _Deref_out_range_(==, Minuend - Subtrahend) _Type* pOutput) \
562 { \
563 if (Minuend >= Subtrahend) \
564 { \
565 *pOutput = Minuend - Subtrahend; \
566 return INTSAFE_SUCCESS; \
567 } \
568 else \
569 { \
570 *pOutput = _Type ## _ERROR; \
571 return INTSAFE_E_ARITHMETIC_OVERFLOW; \
572 } \
573 }
574
575 DEFINE_SAFE_SUB(UInt8Sub, UINT8)
576 DEFINE_SAFE_SUB(UShortSub, USHORT)
577 DEFINE_SAFE_SUB(UIntSub, UINT)
578 DEFINE_SAFE_SUB(UIntPtrSub, UINT_PTR)
579 DEFINE_SAFE_SUB(ULongSub, ULONG)
580 DEFINE_SAFE_SUB(ULongPtrSub, ULONG_PTR)
581 DEFINE_SAFE_SUB(DWordPtrSub, DWORD_PTR)
582 DEFINE_SAFE_SUB(SizeTSub, size_t)
583 DEFINE_SAFE_SUB(SIZETSub, SIZE_T)
584 DEFINE_SAFE_SUB(ULongLongSub, ULONGLONG)
585
586 #ifdef ENABLE_INTSAFE_SIGNED_FUNCTIONS
587 _Must_inspect_result_
588 __forceinline
589 INTSAFE_RESULT
590 INTSAFE_NAME(LongLongAdd)(
591 _In_ LONGLONG Augend,
592 _In_ LONGLONG Addend,
593 _Out_ _Deref_out_range_(==, Augend + Addend) LONGLONG* pResult)
594 {
595 LONGLONG Result = Augend + Addend;
596
597 /* The only way the result can overflow, is when the sign of the augend
598 and the addend are the same. In that case the result is expected to
599 have the same sign as the two, otherwise it overflowed.
600 Sign equality is checked with a binary xor operation. */
601 if ( ((Augend ^ Addend) >= 0) && ((Augend ^ Result) < 0) )
602 {
603 *pResult = LONGLONG_ERROR;
604 return INTSAFE_E_ARITHMETIC_OVERFLOW;
605 }
606 else
607 {
608 *pResult = Result;
609 return INTSAFE_SUCCESS;
610 }
611 }
612
613
614 #define DEFINE_SAFE_ADD_S(_Name, _Type1, _Type2, _Convert) \
615 C_ASSERT(sizeof(_Type2) > sizeof(_Type1)); \
616 _Must_inspect_result_ \
617 __forceinline \
618 INTSAFE_RESULT \
619 INTSAFE_NAME(_Name)( \
620 _In_ _Type1 Augend, \
621 _In_ _Type1 Addend, \
622 _Out_ _Deref_out_range_(==, Augend + Addend) _Type1* pOutput) \
623 { \
624 return INTSAFE_NAME(_Convert)(((_Type2)Augend) + ((_Type2)Addend), pOutput); \
625 }
626
627 DEFINE_SAFE_ADD_S(Int8Add, INT8, SHORT, ShortToInt8)
628 DEFINE_SAFE_ADD_S(ShortAdd, SHORT, INT, IntToShort)
629 DEFINE_SAFE_ADD_S(IntAdd, INT, LONGLONG, LongLongToInt)
630 DEFINE_SAFE_ADD_S(LongAdd, LONG, LONGLONG, LongLongToLong)
631 #ifndef _WIN64
632 DEFINE_SAFE_ADD_S(IntPtrAdd, INT_PTR, LONGLONG, LongLongToIntPtr)
633 DEFINE_SAFE_ADD_S(LongPtrAdd, LONG_PTR, LONGLONG, LongLongToLongPtr)
634 #endif
635
636 _Must_inspect_result_
637 __forceinline
638 INTSAFE_RESULT
639 INTSAFE_NAME(LongLongSub)(
640 _In_ LONGLONG Minuend,
641 _In_ LONGLONG Subtrahend,
642 _Out_ _Deref_out_range_(==, Minuend - Subtrahend) LONGLONG* pResult)
643 {
644 LONGLONG Result = Minuend - Subtrahend;
645
646 /* The only way the result can overflow, is when the sign of the minuend
647 and the subtrahend differ. In that case the result is expected to
648 have the same sign as the minuend, otherwise it overflowed.
649 Sign equality is checked with a binary xor operation. */
650 if ( ((Minuend ^ Subtrahend) < 0) && ((Minuend ^ Result) < 0) )
651 {
652 *pResult = LONGLONG_ERROR;
653 return INTSAFE_E_ARITHMETIC_OVERFLOW;
654 }
655 else
656 {
657 *pResult = Result;
658 return INTSAFE_SUCCESS;
659 }
660 }
661
662
663 #define DEFINE_SAFE_SUB_S(_Name, _Type1, _Type2, _Convert) \
664 C_ASSERT(sizeof(_Type2) > sizeof(_Type1)); \
665 _Must_inspect_result_ \
666 __forceinline \
667 INTSAFE_RESULT \
668 INTSAFE_NAME(_Name)( \
669 _In_ _Type1 Minuend, \
670 _In_ _Type1 Subtrahend, \
671 _Out_ _Deref_out_range_(==, Minuend - Subtrahend) _Type1* pOutput) \
672 { \
673 return INTSAFE_NAME(_Convert)(((_Type2)Minuend) - ((_Type2)Subtrahend), pOutput); \
674 }
675
676 DEFINE_SAFE_SUB_S(LongSub, LONG, LONGLONG, LongLongToLong)
677 #ifndef _WIN64
678 DEFINE_SAFE_SUB_S(IntPtrSub, INT_PTR, LONGLONG, LongLongToIntPtr)
679 DEFINE_SAFE_SUB_S(LongPtrSub, LONG_PTR, LONGLONG, LongLongToLongPtr)
680 #endif
681
682 #endif /* ENABLE_INTSAFE_SIGNED_FUNCTIONS */
683
684 _Must_inspect_result_
685 __forceinline
686 INTSAFE_RESULT
687 INTSAFE_NAME(ULongLongMult)(
688 _In_ ULONGLONG Multiplicand,
689 _In_ ULONGLONG Multiplier,
690 _Out_ _Deref_out_range_(==, Multiplicand * Multiplier) ULONGLONG* pOutput)
691 {
692 /* We can split the 64 bit numbers in low and high parts:
693 M1 = M1Low + M1Hi * 0x100000000
694 M2 = M2Low + M2Hi * 0x100000000
695
696 Then the multiplication looks like this:
697 M1 * M2 = (M1Low + M1Hi * 0x100000000) * (M2Low + M2Hi * 0x100000000)
698 = M1Low * M2Low
699 + M1Low * M2Hi * 0x100000000
700 + M2Low * M1Hi * 0x100000000
701 + M1Hi * M2Hi * 0x100000000 * 0x100000000
702
703 We get an overflow when
704 a) M1Hi * M2Hi != 0, so when M1Hi and M2Hi are both not 0
705 b) The product of the nonzero high part and the other low part
706 is larger than 32 bits.
707 c) The addition of the product from b) shifted left by 32 and
708 M1Low * M2Low is larger than 64 bits
709 */
710 ULONG M1Low = Multiplicand & 0xffffffff;
711 ULONG M2Low = Multiplier & 0xffffffff;
712 ULONG M1Hi = Multiplicand >> 32;
713 ULONG M2Hi = Multiplier >> 32;
714 ULONGLONG Temp;
715
716 if (M1Hi == 0)
717 {
718 Temp = UInt32x32To64(M1Low, M2Hi);
719 }
720 else if (M2Hi == 0)
721 {
722 Temp = UInt32x32To64(M1Hi, M2Low);
723 }
724 else
725 {
726 *pOutput = ULONGLONG_ERROR;
727 return INTSAFE_E_ARITHMETIC_OVERFLOW;
728 }
729
730 if (Temp > ULONG_MAX)
731 {
732 *pOutput = ULONGLONG_ERROR;
733 return INTSAFE_E_ARITHMETIC_OVERFLOW;
734 }
735
736 return INTSAFE_NAME(ULongLongAdd)(Temp << 32, UInt32x32To64(M1Low, M2Low), pOutput);
737 }
738
739
740 #define DEFINE_SAFE_MULT_U32(_Name, _Type, _Convert) \
741 _Must_inspect_result_ \
742 __forceinline \
743 INTSAFE_RESULT \
744 INTSAFE_NAME(_Name)( \
745 _In_ _Type Multiplicand, \
746 _In_ _Type Multiplier, \
747 _Out_ _Deref_out_range_(==, Multiplicand * Multiplier) _Type* pOutput) \
748 { \
749 ULONGLONG Result = UInt32x32To64(Multiplicand, Multiplier); \
750 return INTSAFE_NAME(_Convert)(Result, pOutput); \
751 }
752
753 DEFINE_SAFE_MULT_U32(ULongMult, ULONG, ULongLongToULong)
754 #ifndef _WIN64
755 DEFINE_SAFE_MULT_U32(SizeTMult, size_t, ULongLongToSizeT)
756 DEFINE_SAFE_MULT_U32(SIZETMult, SIZE_T, ULongLongToSIZET)
757 #endif
758
759 #define DEFINE_SAFE_MULT_U16(_Name, _Type, _Convert) \
760 _Must_inspect_result_ \
761 __forceinline \
762 INTSAFE_RESULT \
763 INTSAFE_NAME(_Name)( \
764 _In_ _Type Multiplicand, \
765 _In_ _Type Multiplier, \
766 _Out_ _Deref_out_range_(==, Multiplicand * Multiplier) _Type* pOutput) \
767 { \
768 ULONG Result = ((ULONG)Multiplicand) * ((ULONG)Multiplier); \
769 return INTSAFE_NAME(_Convert)(Result, pOutput); \
770 }
771
772 DEFINE_SAFE_MULT_U16(UShortMult, USHORT, ULongToUShort)
773
774
775 #ifdef _NTINTSAFE_H_INCLUDED_
776
777 #define RtlUInt16Add RtlUShortAdd
778 #define RtlWordAdd RtlUShortAdd
779 #define RtlUInt32Add RtlUIntAdd
780 #define RtlDWordAdd RtlULongAdd
781 #define RtlDWordLongAdd RtlULongLongAdd
782 #define RtlULong64Add RtlULongLongAdd
783 #define RtlDWord64Add RtlULongLongAdd
784 #define RtlUInt64Add RtlULongLongAdd
785 #define RtlUInt16Sub RtlUShortSub
786 #define RtlWordSub RtlUShortSub
787 #define RtlUInt32Sub RtlUIntSub
788 #define RtlDWordSub RtlULongSub
789 #define RtlDWordLongSub RtlULongLongSub
790 #define RtlULong64Sub RtlULongLongSub
791 #define RtlDWord64Sub RtlULongLongSub
792 #define RtlUInt64Sub RtlULongLongSub
793 #define RtlUInt16Mult RtlUShortMult
794 #define RtlWordMult RtlUShortMult
795 #ifdef _WIN64
796 #define RtlIntPtrAdd RtlLongLongAdd
797 #define RtlLongPtrAdd RtlLongLongAdd
798 #define RtlIntPtrSub RtlLongLongSub
799 #define RtlLongPtrSub RtlLongLongSub
800 #define RtlSizeTMult RtlULongLongMult
801 #define RtlSIZETMult RtlULongLongMult
802 #else
803 #endif
804
805 #else // _NTINTSAFE_H_INCLUDED_
806
807 #define UInt16Add UShortAdd
808 #define WordAdd UShortAdd
809 #define UInt32Add UIntAdd
810 #define DWordAdd ULongAdd
811 #define DWordLongAdd ULongLongAdd
812 #define ULong64Add ULongLongAdd
813 #define DWord64Add ULongLongAdd
814 #define UInt64Add ULongLongAdd
815 #define UInt16Sub UShortSub
816 #define WordSub UShortSub
817 #define UInt32Sub UIntSub
818 #define DWordSub ULongSub
819 #define DWordLongSub ULongLongSub
820 #define ULong64Sub ULongLongSub
821 #define DWord64Sub ULongLongSub
822 #define UInt64Sub ULongLongSub
823 #define UInt16Mult UShortMult
824 #define WordMult UShortMult
825 #ifdef _WIN64
826 #define IntPtrAdd LongLongAdd
827 #define LongPtrAdd LongLongAdd
828 #define IntPtrSub LongLongSub
829 #define LongPtrSub LongLongSub
830 #define SizeTMult ULongLongMult
831 #define SIZETMult ULongLongMult
832 #else
833 #endif
834
835 #undef _INTSAFE_CHAR_MIN
836 #undef _INTSAFE_CHAR_MAX
837 #undef _INTSAFE_CHAR_ERROR
838
839 #endif // _NTINTSAFE_H_INCLUDED_
840
841 #endif // !_INTSAFE_H_INCLUDED_