reactos/include/psdk/intsafe.h

   1 /*!
   2  * \file intsafe.h
   3  *
   4  * \brief Windows helper functions for integer overflow prevention
   5  *
   6  * \package This file is part of the ReactOS PSDK package.
   7  *
   8  * \author
   9  *   Timo Kreuzer (timo.kreuzer@reactos.org)
  10  *
  11  * \copyright THIS SOFTWARE IS NOT COPYRIGHTED
  12  *
  13  * This source code is offered for use in the public domain. You may
  14  * use, modify or distribute it freely.
  15  *
  16  * This code is distributed in the hope that it will be useful but
  17  * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
  18  * DISCLAIMED. This includes but is not limited to warranties of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * \todo
  22  * - missing conversion functions
  23  * - multiplication functions
  24  * - signed add, sub and multiply functions
  25  */
  26 #pragma once
  27
  28 #ifndef _INTSAFE_H_INCLUDED_
  29 #define _INTSAFE_H_INCLUDED_
  30
  31 #include <specstrings.h>
  32
  33 #if defined(__GNUC__) && !defined(__forceinline)
  34 # if ( __MINGW_GNUC_PREREQ(4, 3)  &&  __STDC_VERSION__ >= 199901L)
  35 #  define __forceinline extern inline __attribute__((__always_inline__,__gnu_inline__))
  36 # else
  37 #  define __forceinline extern __inline__ __attribute__((__always_inline__))
  38 # endif
  39 #endif
  40
  41 /* Handle ntintsafe here too */
  42 #ifdef _NTINTSAFE_H_INCLUDED_
  43 #ifndef _NTDEF_ /* Guard agains redefinition from ntstatus.h */
  44 typedef _Return_type_success_(return >= 0) long NTSTATUS;
  45 #endif
  46 #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
  47 #define STATUS_SUCCESS ((NTSTATUS)0x00000000)
  48 #define STATUS_INTEGER_OVERFLOW ((NTSTATUS)0xC0000095)
  49 #define INTSAFE_RESULT NTSTATUS
  50 #define INTSAFE_SUCCESS STATUS_SUCCESS
  51 #define INTSAFE_E_ARITHMETIC_OVERFLOW STATUS_INTEGER_OVERFLOW
  52 #define INTSAFE_NAME(name) Rtl##name
  53 #else // _NTINTSAFE_H_INCLUDED_
  54 #ifndef _HRESULT_DEFINED
  55 typedef _Return_type_success_(return >= 0) long HRESULT;
  56 #endif
  57 #define SUCCEEDED(hr) (((HRESULT)(hr)) >= 0)
  58 #define FAILED(hr) (((HRESULT)(hr)) < 0)
  59 #define S_OK    ((HRESULT)0L)
  60 #define INTSAFE_RESULT HRESULT
  61 #define INTSAFE_SUCCESS S_OK
  62 #define INTSAFE_E_ARITHMETIC_OVERFLOW ((HRESULT)0x80070216L)
  63 #define INTSAFE_NAME(name) name
  64 #endif // _NTINTSAFE_H_INCLUDED_
  65
  66 #if !defined(_W64)
  67 #if defined(_MSC_VER) && !defined(__midl) && (defined(_M_IX86) || defined(_M_ARM))
  68 #define _W64 __w64
  69 #else
  70 #define _W64
  71 #endif
  72 #endif
  73
  74 /* Static assert */
  75 #ifndef C_ASSERT
  76 #ifdef _MSC_VER
  77 # define C_ASSERT(e) typedef char __C_ASSERT__[(e)?1:-1]
  78 #else
  79 # define C_ASSERT(e) extern void __C_ASSERT__(int [(e)?1:-1])
  80 #endif
  81 #endif /* C_ASSERT */
  82
  83 /* Typedefs */
  84 #ifndef _WINNT_
  85 #ifndef _NTDEF_
  86 typedef char CHAR;
  87 typedef unsigned char UCHAR, UINT8;
  88 typedef signed char INT8;
  89 typedef short SHORT;
  90 typedef signed short INT16;
  91 typedef unsigned short USHORT, UINT16;
  92 typedef int INT;
  93 typedef unsigned int UINT32;
  94 typedef signed int INT32;
  95 typedef long LONG;
  96 typedef unsigned long ULONG;
  97 typedef long long LONGLONG, LONG64;
  98 typedef signed long long INT64;
  99 typedef unsigned long long ULONGLONG, DWORDLONG, ULONG64, DWORD64, UINT64;
 100 #ifdef _WIN64
 101 typedef long long INT_PTR, LONG_PTR, SSIZE_T, ptrdiff_t;
 102 typedef unsigned long long UINT_PTR, ULONG_PTR, DWORD_PTR, SIZE_T, size_t;
 103 #else // _WIN64
 104 typedef _W64 int INT_PTR, ptrdiff_t;
 105 typedef _W64 unsigned int UINT_PTR, size_t;
 106 typedef _W64 long LONG_PTR, SSIZE_T;
 107 typedef _W64 unsigned long ULONG_PTR, DWORD_PTR, SIZE_T;
 108 #endif // _WIN64
 109 #endif
 110 typedef unsigned char BYTE;
 111 typedef unsigned short WORD;
 112 typedef unsigned int UINT;
 113 typedef unsigned long DWORD;
 114 #endif // _WINNT_
 115
 116 /* Just to be sure! */
 117 C_ASSERT(sizeof(USHORT) == 2);
 118 C_ASSERT(sizeof(INT) == 4);
 119 C_ASSERT(sizeof(UINT) == 4);
 120 C_ASSERT(sizeof(LONG) == 4);
 121 C_ASSERT(sizeof(ULONG) == 4);
 122 C_ASSERT(sizeof(DWORD) == 4);
 123 C_ASSERT(sizeof(UINT_PTR) == sizeof(ULONG_PTR));
 124
 125 /* Undefine these to avoid conflicts with limits.h */
 126 #undef CHAR_MIN
 127 #undef CHAR_MAX
 128 #undef INT_MIN
 129 #undef INT_MAX
 130 #undef LONG_MIN
 131 #undef LONG_MAX
 132 #undef UCHAR_MAX
 133 #undef UINT_MAX
 134 #undef ULONG_MAX
 135
 136 /* Integer range margins (use (x-1) to prevent warnings) */
 137 #define INT8_MIN (-127 - 1)
 138 #define SHORT_MIN (-32767 - 1)
 139 #define INT16_MIN (-32767 - 1)
 140 #define INT_MIN (-2147483647 - 1)
 141 #define INT32_MIN (-2147483647 - 1)
 142 #define LONG_MIN (-2147483647L - 1)
 143 #define LONGLONG_MIN (-9223372036854775807LL - 1)
 144 #define LONG64_MIN (-9223372036854775807LL - 1)
 145 #define INT64_MIN (-9223372036854775807LL - 1)
 146 //#define INT128_MIN (-170141183460469231731687303715884105728)
 147 #ifdef _WIN64
 148 #define INT_PTR_MIN INT64_MIN
 149 #define LONG_PTR_MIN LONG64_MIN
 150 #define PTRDIFF_T_MIN INT64_MIN
 151 #define SSIZE_T_MIN INT64_MIN
 152 #else // _WIN64
 153 #define INT_PTR_MIN INT_MIN
 154 #define LONG_PTR_MIN LONG_MIN
 155 #define PTRDIFF_T_MIN INT_MIN
 156 #define SSIZE_T_MIN INT_MIN
 157 #endif // _WIN64
 158
 159 #define INT8_MAX 127
 160 #define UINT8_MAX 0xff
 161 #define UCHAR_MAX 0xff
 162 #define BYTE_MAX 0xff
 163 #define SHORT_MAX 32767
 164 #define INT16_MAX 32767
 165 #define USHORT_MAX 0xffff
 166 #define UINT16_MAX 0xffff
 167 #define WORD_MAX 0xffff
 168 #define INT_MAX 2147483647
 169 #define INT32_MAX 2147483647
 170 #define UINT_MAX 0xffffffffU
 171 #define UINT32_MAX 0xffffffffU
 172 #define LONG_MAX 2147483647L
 173 #define ULONG_MAX 0xffffffffUL
 174 #define DWORD_MAX 0xffffffffUL
 175 #define LONGLONG_MAX 9223372036854775807LL
 176 #define LONG64_MAX 9223372036854775807LL
 177 #define INT64_MAX 9223372036854775807LL
 178 #define ULONGLONG_MAX 0xffffffffffffffffULL
 179 #define DWORDLONG_MAX 0xffffffffffffffffULL
 180 #define ULONG64_MAX 0xffffffffffffffffULL
 181 #define DWORD64_MAX 0xffffffffffffffffULL
 182 #define UINT64_MAX 0xffffffffffffffffULL
 183 #define INT128_MAX 170141183460469231731687303715884105727
 184 #define UINT128_MAX 0xffffffffffffffffffffffffffffffff
 185 #undef SIZE_T_MAX
 186 #ifdef _WIN64
 187 #define INT_PTR_MAX INT64_MAX
 188 #define UINT_PTR_MAX UINT64_MAX
 189 #define LONG_PTR_MAX LONG64_MAX
 190 #define ULONG_PTR_MAX ULONG64_MAX
 191 #define DWORD_PTR_MAX DWORD64_MAX
 192 #define PTRDIFF_T_MAX INT64_MAX
 193 #define SIZE_T_MAX UINT64_MAX
 194 #define SSIZE_T_MAX INT64_MAX
 195 #define _SIZE_T_MAX UINT64_MAX
 196 #else // _WIN64
 197 #define INT_PTR_MAX INT_MAX
 198 #define UINT_PTR_MAX UINT_MAX
 199 #define LONG_PTR_MAX LONG_MAX
 200 #define ULONG_PTR_MAX ULONG_MAX
 201 #define DWORD_PTR_MAX DWORD_MAX
 202 #define PTRDIFF_T_MAX INT_MAX
 203 #define SIZE_T_MAX UINT_MAX
 204 #define SSIZE_T_MAX INT_MAX
 205 #define _SIZE_T_MAX UINT_MAX
 206 #endif // _WIN64
 207
 208 #ifndef CHAR_MIN
 209 #ifdef _CHAR_UNSIGNED
 210 #define CHAR_MIN 0
 211 #define CHAR_MAX 0xff
 212 #else
 213 #define CHAR_MIN (-128)
 214 #define CHAR_MAX 127
 215 #endif
 216 #endif
 217
 218 /* Error values */
 219 #define INT8_ERROR (-1)
 220 #define UINT8_ERROR 0xff
 221 #define BYTE_ERROR 0xff
 222 #define SHORT_ERROR (-1)
 223 #define INT16_ERROR (-1)
 224 #define USHORT_ERROR 0xffff
 225 #define UINT16_ERROR 0xffff
 226 #define WORD_ERROR 0xffff
 227 #define INT_ERROR (-1)
 228 #define INT32_ERROR (-1)
 229 #define UINT_ERROR 0xffffffff
 230 #define UINT32_ERROR 0xffffffff
 231 #define LONG_ERROR (-1L)
 232 #define ULONG_ERROR 0xffffffffUL
 233 #define DWORD_ERROR 0xffffffffUL
 234 #define LONGLONG_ERROR (-1LL)
 235 #define LONG64_ERROR (-1LL)
 236 #define INT64_ERROR (-1LL)
 237 #define ULONGLONG_ERROR 0xffffffffffffffffULL
 238 #define DWORDLONG_ERROR 0xffffffffffffffffULL
 239 #define ULONG64_ERROR 0xffffffffffffffffULL
 240 #define UINT64_ERROR 0xffffffffffffffffULL
 241 #ifdef _WIN64
 242 #define INT_PTR_ERROR (-1LL)
 243 #define UINT_PTR_ERROR 0xffffffffffffffffULL
 244 #define LONG_PTR_ERROR (-1LL)
 245 #define ULONG_PTR_ERROR 0xffffffffffffffffULL
 246 #define DWORD_PTR_ERROR 0xffffffffffffffffULL
 247 #define PTRDIFF_T_ERROR (-1LL)
 248 #define SIZE_T_ERROR 0xffffffffffffffffULL
 249 #define SSIZE_T_ERROR (-1LL)
 250 #define _SIZE_T_ERROR 0xffffffffffffffffULL
 251 #else // _WIN64
 252 #define INT_PTR_ERROR (-1)
 253 #define UINT_PTR_ERROR 0xffffffff
 254 #define LONG_PTR_ERROR (-1L)
 255 #define ULONG_PTR_ERROR 0xffffffffUL
 256 #define DWORD_PTR_ERROR 0xffffffffUL
 257 #define PTRDIFF_T_ERROR (-1)
 258 #define SIZE_T_ERROR 0xffffffff
 259 #define SSIZE_T_ERROR (-1L)
 260 #define _SIZE_T_ERROR 0xffffffffUL
 261 #endif // _WIN64
 262
 263 #define size_t_ERROR SIZE_T_ERROR
 264 #define UCHAR_ERROR '\0'
 265 #define CHAR_ERROR '\0'
 266
 267 /* 32 bit x 32 bit to 64 bit unsigned multiplication */
 268 #ifndef UInt32x32To64
 269 #define UInt32x32To64(a,b) ((unsigned __int64)(unsigned int)(a)*(unsigned __int64)(unsigned int)(b))
 270 #endif
 271
 272 /* Convert unsigned to signed or unsigned */
 273 #define DEFINE_SAFE_CONVERT_UTOX(_Name, _TypeFrom, _TypeTo) \
 274 _Must_inspect_result_ \
 275 __forceinline \
 276 INTSAFE_RESULT \
 277 INTSAFE_NAME(_Name)( \
 278     _In_ _TypeFrom Input, \
 279     _Out_ _Deref_out_range_(==, Input) _TypeTo *pOutput) \
 280 { \
 281     if (Input <= _TypeTo ## _MAX) \
 282     { \
 283         *pOutput = (_TypeTo)Input; \
 284         return INTSAFE_SUCCESS; \
 285     } \
 286     else \
 287     { \
 288         *pOutput = _TypeTo ## _ERROR; \
 289         return INTSAFE_E_ARITHMETIC_OVERFLOW; \
 290     } \
 291 }
 292
 293 DEFINE_SAFE_CONVERT_UTOX(ByteToChar, BYTE, CHAR)
 294 DEFINE_SAFE_CONVERT_UTOX(ByteToInt8, BYTE, INT8)
 295 DEFINE_SAFE_CONVERT_UTOX(UInt8ToChar, UINT8, CHAR)
 296 DEFINE_SAFE_CONVERT_UTOX(UInt8ToInt8, UINT8, INT8)
 297 DEFINE_SAFE_CONVERT_UTOX(UShortToChar, USHORT, CHAR)
 298 DEFINE_SAFE_CONVERT_UTOX(UShortToUChar, USHORT, UCHAR)
 299 DEFINE_SAFE_CONVERT_UTOX(UShortToInt8, USHORT, INT8)
 300 DEFINE_SAFE_CONVERT_UTOX(UShortToUInt8, USHORT, UINT8)
 301 DEFINE_SAFE_CONVERT_UTOX(UShortToShort, USHORT, SHORT)
 302 DEFINE_SAFE_CONVERT_UTOX(UIntToUChar, UINT, UCHAR)
 303 DEFINE_SAFE_CONVERT_UTOX(UIntToInt8, UINT, INT8)
 304 DEFINE_SAFE_CONVERT_UTOX(UIntToUInt8, UINT, UINT8)
 305 DEFINE_SAFE_CONVERT_UTOX(UIntToShort, UINT, SHORT)
 306 DEFINE_SAFE_CONVERT_UTOX(UIntToUShort, UINT, USHORT)
 307 DEFINE_SAFE_CONVERT_UTOX(UIntToInt, UINT, INT)
 308 DEFINE_SAFE_CONVERT_UTOX(UIntToLong, UINT, LONG)
 309 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToUChar, UINT_PTR, UCHAR)
 310 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToInt8, UINT_PTR, INT8)
 311 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToUInt8, UINT_PTR, UINT8)
 312 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToShort, UINT_PTR, SHORT)
 313 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToUShort, UINT_PTR, USHORT)
 314 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToInt16, UINT_PTR, INT16)
 315 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToUInt16, UINT_PTR, UINT16)
 316 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToInt, UINT_PTR, INT)
 317 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToLong, UINT_PTR, LONG)
 318 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToIntPtr, UINT_PTR, INT_PTR)
 319 DEFINE_SAFE_CONVERT_UTOX(UIntPtrToLongPtr, UINT_PTR, LONG_PTR)
 320 DEFINE_SAFE_CONVERT_UTOX(ULongToUChar, ULONG, UCHAR)
 321 DEFINE_SAFE_CONVERT_UTOX(ULongToUInt8, ULONG, UINT8)
 322 DEFINE_SAFE_CONVERT_UTOX(ULongToShort, ULONG, SHORT)
 323 DEFINE_SAFE_CONVERT_UTOX(ULongToUShort, ULONG, USHORT)
 324 DEFINE_SAFE_CONVERT_UTOX(ULongToInt, ULONG, INT)
 325 DEFINE_SAFE_CONVERT_UTOX(ULongToUInt, ULONG, UINT)
 326 DEFINE_SAFE_CONVERT_UTOX(ULongToIntPtr, ULONG, INT_PTR)
 327 DEFINE_SAFE_CONVERT_UTOX(ULongToUIntPtr, ULONG, UINT_PTR)
 328 DEFINE_SAFE_CONVERT_UTOX(ULongToLongPtr, ULONG, LONG_PTR)
 329 DEFINE_SAFE_CONVERT_UTOX(ULongPtrToULong, ULONG_PTR, ULONG)
 330 DEFINE_SAFE_CONVERT_UTOX(ULongLongToUInt, ULONGLONG, UINT)
 331 DEFINE_SAFE_CONVERT_UTOX(ULongLongToULong, ULONGLONG, ULONG)
 332 DEFINE_SAFE_CONVERT_UTOX(ULongLongToULongPtr, ULONGLONG, ULONG_PTR)
 333
 334
 335 /* Convert signed to unsigned */
 336 #define DEFINE_SAFE_CONVERT_STOU(_Name, _TypeFrom, _TypeTo) \
 337 _Must_inspect_result_ \
 338 __forceinline \
 339 INTSAFE_RESULT \
 340 INTSAFE_NAME(_Name)( \
 341     _In_ _TypeFrom Input, \
 342     _Out_ _Deref_out_range_(==, Input) _TypeTo *pOutput) \
 343 { \
 344     if ((Input >= 0) && \
 345         ((sizeof(_TypeFrom) <= sizeof(_TypeTo)) || (Input <= (_TypeFrom)_TypeTo ## _MAX))) \
 346     { \
 347         *pOutput = (_TypeTo)Input; \
 348         return INTSAFE_SUCCESS; \
 349     } \
 350     else \
 351     { \
 352         *pOutput = _TypeTo ## _ERROR; \
 353         return INTSAFE_E_ARITHMETIC_OVERFLOW; \
 354     } \
 355 }
 356
 357 DEFINE_SAFE_CONVERT_STOU(Int8ToUChar, INT8, UCHAR)
 358 DEFINE_SAFE_CONVERT_STOU(Int8ToUInt8, INT8, UINT8)
 359 DEFINE_SAFE_CONVERT_STOU(Int8ToUShort, INT8, USHORT)
 360 DEFINE_SAFE_CONVERT_STOU(Int8ToUInt, INT8, UINT)
 361 DEFINE_SAFE_CONVERT_STOU(Int8ToULong, INT8, ULONG)
 362 DEFINE_SAFE_CONVERT_STOU(Int8ToUIntPtr, INT8, UINT_PTR)
 363 DEFINE_SAFE_CONVERT_STOU(Int8ToULongPtr, INT8, ULONG_PTR)
 364 DEFINE_SAFE_CONVERT_STOU(Int8ToULongLong, INT8, ULONGLONG)
 365 DEFINE_SAFE_CONVERT_STOU(ShortToUChar, SHORT, UCHAR)
 366 DEFINE_SAFE_CONVERT_STOU(ShortToUInt8, SHORT, UINT8)
 367 DEFINE_SAFE_CONVERT_STOU(ShortToUShort, SHORT, USHORT)
 368 DEFINE_SAFE_CONVERT_STOU(ShortToUInt, SHORT, UINT)
 369 DEFINE_SAFE_CONVERT_STOU(ShortToULong, SHORT, ULONG)
 370 DEFINE_SAFE_CONVERT_STOU(ShortToUIntPtr, SHORT, UINT_PTR)
 371 DEFINE_SAFE_CONVERT_STOU(ShortToULongPtr, SHORT, ULONG_PTR)
 372 DEFINE_SAFE_CONVERT_STOU(ShortToDWordPtr, SHORT, DWORD_PTR)
 373 DEFINE_SAFE_CONVERT_STOU(ShortToULongLong, SHORT, ULONGLONG)
 374 DEFINE_SAFE_CONVERT_STOU(IntToUChar, INT, UCHAR)
 375 DEFINE_SAFE_CONVERT_STOU(IntToUInt8, INT, UINT8)
 376 DEFINE_SAFE_CONVERT_STOU(IntToUShort, INT, USHORT)
 377 DEFINE_SAFE_CONVERT_STOU(IntToUInt, INT, UINT)
 378 DEFINE_SAFE_CONVERT_STOU(IntToULong, INT, ULONG)
 379 DEFINE_SAFE_CONVERT_STOU(IntToULongLong, INT, ULONGLONG)
 380 DEFINE_SAFE_CONVERT_STOU(LongToUChar, LONG, UCHAR)
 381 DEFINE_SAFE_CONVERT_STOU(LongToUInt8, LONG, UINT8)
 382 DEFINE_SAFE_CONVERT_STOU(LongToUShort, LONG, USHORT)
 383 DEFINE_SAFE_CONVERT_STOU(LongToUInt, LONG, UINT)
 384 DEFINE_SAFE_CONVERT_STOU(LongToULong, LONG, ULONG)
 385 DEFINE_SAFE_CONVERT_STOU(LongToUIntPtr, LONG, UINT_PTR)
 386 DEFINE_SAFE_CONVERT_STOU(LongToULongPtr, LONG, ULONG_PTR)
 387 DEFINE_SAFE_CONVERT_STOU(LongToULongLong, LONG, ULONGLONG)
 388 DEFINE_SAFE_CONVERT_STOU(IntPtrToUChar, INT_PTR, UCHAR)
 389 DEFINE_SAFE_CONVERT_STOU(IntPtrToUInt8, INT_PTR, UINT8)
 390 DEFINE_SAFE_CONVERT_STOU(IntPtrToUShort, INT_PTR, USHORT)
 391 DEFINE_SAFE_CONVERT_STOU(IntPtrToUInt, INT_PTR, UINT)
 392 DEFINE_SAFE_CONVERT_STOU(IntPtrToULong, INT_PTR, ULONG)
 393 DEFINE_SAFE_CONVERT_STOU(IntPtrToUIntPtr, INT_PTR, UINT_PTR)
 394 DEFINE_SAFE_CONVERT_STOU(IntPtrToULongPtr, INT_PTR, ULONG_PTR)
 395 DEFINE_SAFE_CONVERT_STOU(IntPtrToULongLong, INT_PTR, ULONGLONG)
 396 DEFINE_SAFE_CONVERT_STOU(LongPtrToUChar, LONG_PTR, UCHAR)
 397 DEFINE_SAFE_CONVERT_STOU(LongPtrToUInt8, LONG_PTR, UINT8)
 398 DEFINE_SAFE_CONVERT_STOU(LongPtrToUShort, LONG_PTR, USHORT)
 399 DEFINE_SAFE_CONVERT_STOU(LongPtrToUInt, LONG_PTR, UINT)
 400 DEFINE_SAFE_CONVERT_STOU(LongPtrToULong, LONG_PTR, ULONG)
 401 DEFINE_SAFE_CONVERT_STOU(LongPtrToUIntPtr, LONG_PTR, UINT_PTR)
 402 DEFINE_SAFE_CONVERT_STOU(LongPtrToULongPtr, LONG_PTR, ULONG_PTR)
 403 DEFINE_SAFE_CONVERT_STOU(LongPtrToULongLong, LONG_PTR, ULONGLONG)
 404 #ifdef _CHAR_UNSIGNED
 405 DEFINE_SAFE_CONVERT_STOU(ShortToChar, SHORT, UCHAR)
 406 DEFINE_SAFE_CONVERT_STOU(LongPtrToChar, LONG_PTR, UCHAR)
 407 #endif
 408
 409
 410 /* Convert signed to signed */
 411 #define DEFINE_SAFE_CONVERT_STOS(_Name, _TypeFrom, _TypeTo) \
 412 _Must_inspect_result_ \
 413 __forceinline \
 414 INTSAFE_RESULT \
 415 INTSAFE_NAME(_Name)( \
 416     _In_ _TypeFrom Input, \
 417     _Out_ _Deref_out_range_(==, Input) _TypeTo *pOutput) \
 418 { \
 419     if ((Input >= _TypeTo ## _MIN) && (Input <= _TypeTo ## _MAX)) \
 420     { \
 421         *pOutput = (_TypeTo)Input; \
 422         return INTSAFE_SUCCESS; \
 423     } \
 424     else \
 425     { \
 426         *pOutput = _TypeTo ## _ERROR; \
 427         return INTSAFE_E_ARITHMETIC_OVERFLOW; \
 428     } \
 429 }
 430
 431 DEFINE_SAFE_CONVERT_STOS(ShortToInt8, SHORT, INT8)
 432 DEFINE_SAFE_CONVERT_STOS(IntToInt8, INT, INT8)
 433 DEFINE_SAFE_CONVERT_STOS(IntToShort, INT, SHORT)
 434 DEFINE_SAFE_CONVERT_STOS(LongToInt8, LONG, INT8)
 435 DEFINE_SAFE_CONVERT_STOS(LongToShort, LONG, SHORT)
 436 DEFINE_SAFE_CONVERT_STOS(LongToInt, LONG, INT)
 437 DEFINE_SAFE_CONVERT_STOS(IntPtrToInt8, INT_PTR, INT8)
 438 DEFINE_SAFE_CONVERT_STOS(IntPtrToShort, INT_PTR, SHORT)
 439 DEFINE_SAFE_CONVERT_STOS(IntPtrToInt, INT_PTR, INT)
 440 DEFINE_SAFE_CONVERT_STOS(IntPtrToLong, INT_PTR, LONG)
 441 DEFINE_SAFE_CONVERT_STOS(IntPtrToLongPtr, INT_PTR, LONG_PTR)
 442 DEFINE_SAFE_CONVERT_STOS(LongPtrToInt8, LONG_PTR, INT8)
 443 DEFINE_SAFE_CONVERT_STOS(LongPtrToShort, LONG_PTR, SHORT)
 444 DEFINE_SAFE_CONVERT_STOS(LongPtrToInt, LONG_PTR, INT)
 445 DEFINE_SAFE_CONVERT_STOS(LongPtrToLong, LONG_PTR, LONG)
 446 DEFINE_SAFE_CONVERT_STOS(LongPtrToIntPtr, LONG_PTR, INT_PTR)
 447 DEFINE_SAFE_CONVERT_STOS(LongLongToLong, LONGLONG, LONG)
 448 DEFINE_SAFE_CONVERT_STOS(LongLongToIntPtr, LONGLONG, INT_PTR)
 449 DEFINE_SAFE_CONVERT_STOS(LongLongToLongPtr, LONGLONG, LONG_PTR)
 450 #ifndef _CHAR_UNSIGNED
 451 DEFINE_SAFE_CONVERT_STOS(ShortToChar, SHORT, CHAR)
 452 DEFINE_SAFE_CONVERT_STOS(LongPtrToChar, LONG_PTR, CHAR)
 453 #endif
 454
 455
 456 #ifdef _NTINTSAFE_H_INCLUDED_
 457
 458 #define RtlInt8ToByte RtlInt8ToUInt8
 459 #define RtlInt8ToUInt16 RtlInt8ToUShort
 460 #define RtlInt8ToWord RtlInt8ToUShort
 461 #define RtlInt8ToUInt32 RtlInt8ToUInt
 462 #define RtlInt8ToDWord RtlInt8ToULong
 463 #define RtlInt8ToDWordPtr RtlInt8ToULongPtr
 464 #define RtlInt8ToDWordLong RtlInt8ToULongLong
 465 #define RtlInt8ToULong64 RtlInt8ToULongLong
 466 #define RtlInt8ToDWord64 RtlInt8ToULongLong
 467 #define RtlInt8ToUInt64 RtlInt8ToULongLong
 468 #define RtlInt8ToSizeT RtlInt8ToUIntPtr
 469 #define RtlInt8ToSIZET RtlInt8ToULongPtr
 470 #define RtlIntToSizeT RtlIntToUIntPtr
 471 #define RtlIntToSIZET RtlIntToULongPtr
 472 #define RtlULongToSSIZET RtlULongToLongPtr
 473 #define RtlULongToByte RtlULongToUInt8
 474 #define RtlULongLongToInt64 RtlULongLongToLongLong
 475 #define RtlULongLongToLong64 RtlULongLongToLongLong
 476 #define RtlULongLongToPtrdiffT RtlULongLongToIntPtr
 477 #define RtlULongLongToSizeT RtlULongLongToUIntPtr
 478 #define RtlULongLongToSSIZET RtlULongLongToLongPtr
 479 #define RtlULongLongToSIZET RtlULongLongToULongPtr
 480 #define RtlSIZETToULong RtlULongPtrToULong
 481 #define RtlSSIZETToULongLong RtlLongPtrToULongLong
 482 #define RtlSSIZETToULong RtlLongPtrToULong
 483 #ifdef _WIN64
 484 #define RtlIntToUIntPtr RtlIntToULongLong
 485 #define RtlULongLongToIntPtr RtlULongLongToLongLong
 486 #else
 487 #define RtlIntToUIntPtr RtlIntToUInt
 488 #define RtlULongLongToIntPtr RtlULongLongToInt
 489 #define RtlULongLongToUIntPtr RtlULongLongToUInt
 490 #define RtlULongLongToULongPtr RtlULongLongToULong
 491 #endif
 492
 493 #else // _NTINTSAFE_H_INCLUDED_
 494
 495 #define Int8ToByte Int8ToUInt8
 496 #define Int8ToUInt16 Int8ToUShort
 497 #define Int8ToWord Int8ToUShort
 498 #define Int8ToUInt32 Int8ToUInt
 499 #define Int8ToDWord Int8ToULong
 500 #define Int8ToDWordPtr Int8ToULongPtr
 501 #define Int8ToDWordLong Int8ToULongLong
 502 #define Int8ToULong64 Int8ToULongLong
 503 #define Int8ToDWord64 Int8ToULongLong
 504 #define Int8ToUInt64 Int8ToULongLong
 505 #define Int8ToSizeT Int8ToUIntPtr
 506 #define Int8ToSIZET Int8ToULongPtr
 507 #define IntToSizeT IntToUIntPtr
 508 #define IntToSIZET IntToULongPtr
 509 #define ULongToSSIZET ULongToLongPtr
 510 #define ULongToByte ULongToUInt8
 511 #define ULongLongToInt64 ULongLongToLongLong
 512 #define ULongLongToLong64 ULongLongToLongLong
 513 #define ULongLongToPtrdiffT ULongLongToIntPtr
 514 #define ULongLongToSizeT ULongLongToUIntPtr
 515 #define ULongLongToSSIZET ULongLongToLongPtr
 516 #define ULongLongToSIZET ULongLongToULongPtr
 517 #define SIZETToULong ULongPtrToULong
 518 #define SSIZETToULongLong LongPtrToULongLong
 519 #define SSIZETToULong LongPtrToULong
 520 #ifdef _WIN64
 521 #define IntToUIntPtr IntToULongLong
 522 #define ULongLongToIntPtr ULongLongToLongLong
 523 #else
 524 #define IntToUIntPtr IntToUInt
 525 #define ULongLongToIntPtr ULongLongToInt
 526 #define ULongLongToUIntPtr ULongLongToUInt
 527 #define ULongLongToULongPtr ULongLongToULong
 528 #endif
 529
 530 #endif // _NTINTSAFE_H_INCLUDED_
 531
 532
 533 #define DEFINE_SAFE_ADD(_Name, _Type) \
 534 _Must_inspect_result_ \
 535 __forceinline \
 536 INTSAFE_RESULT \
 537 INTSAFE_NAME(_Name)( \
 538     _In_ _Type Augend, \
 539     _In_ _Type Addend, \
 540     _Out_ _Deref_out_range_(==, Augend + Addend) _Type *pOutput) \
 541 { \
 542     if ((Augend + Addend) >= Augend) \
 543     { \
 544         *pOutput = Augend + Addend; \
 545         return INTSAFE_SUCCESS; \
 546     } \
 547     else \
 548     { \
 549         *pOutput = _Type ## _ERROR; \
 550         return INTSAFE_E_ARITHMETIC_OVERFLOW; \
 551     } \
 552 }
 553
 554 DEFINE_SAFE_ADD(UInt8Add, UINT8)
 555 DEFINE_SAFE_ADD(UShortAdd, USHORT)
 556 DEFINE_SAFE_ADD(UIntAdd, UINT)
 557 DEFINE_SAFE_ADD(ULongAdd, ULONG)
 558 DEFINE_SAFE_ADD(UIntPtrAdd, UINT_PTR)
 559 DEFINE_SAFE_ADD(ULongPtrAdd, ULONG_PTR)
 560 DEFINE_SAFE_ADD(DWordPtrAdd, DWORD_PTR)
 561 DEFINE_SAFE_ADD(SizeTAdd, size_t)
 562 DEFINE_SAFE_ADD(SIZETAdd, SIZE_T)
 563 DEFINE_SAFE_ADD(ULongLongAdd, ULONGLONG)
 564
 565
 566 #define DEFINE_SAFE_SUB(_Name, _Type) \
 567 _Must_inspect_result_ \
 568 __forceinline \
 569 INTSAFE_RESULT \
 570 INTSAFE_NAME(_Name)( \
 571     _In_ _Type Minuend, \
 572     _In_ _Type Subtrahend, \
 573     _Out_ _Deref_out_range_(==, Minuend - Subtrahend) _Type* pOutput) \
 574 { \
 575     if (Minuend >= Subtrahend) \
 576     { \
 577         *pOutput = Minuend - Subtrahend; \
 578         return INTSAFE_SUCCESS; \
 579     } \
 580     else \
 581     { \
 582         *pOutput = _Type ## _ERROR; \
 583         return INTSAFE_E_ARITHMETIC_OVERFLOW; \
 584     } \
 585 }
 586
 587 DEFINE_SAFE_SUB(UInt8Sub, UINT8)
 588 DEFINE_SAFE_SUB(UShortSub, USHORT)
 589 DEFINE_SAFE_SUB(UIntSub, UINT)
 590 DEFINE_SAFE_SUB(UIntPtrSub, UINT_PTR)
 591 DEFINE_SAFE_SUB(ULongSub, ULONG)
 592 DEFINE_SAFE_SUB(ULongPtrSub, ULONG_PTR)
 593 DEFINE_SAFE_SUB(DWordPtrSub, DWORD_PTR)
 594 DEFINE_SAFE_SUB(SizeTSub, size_t)
 595 DEFINE_SAFE_SUB(SIZETSub, SIZE_T)
 596 DEFINE_SAFE_SUB(ULongLongSub, ULONGLONG)
 597
 598
 599 _Must_inspect_result_
 600 __forceinline
 601 INTSAFE_RESULT
 602 INTSAFE_NAME(LongLongSub)(
 603     _In_ LONGLONG Minuend,
 604     _In_ LONGLONG Subtrahend,
 605     _Out_ _Deref_out_range_(==, Minuend - Subtrahend) LONGLONG* pResult)
 606 {
 607     LONGLONG Result = Minuend - Subtrahend;
 608
 609     /* The only way the result can overflow, is when the sign of the minuend
 610        and the subtrahend differ. In that case the result is expected to
 611        have the same sign as the minuend, otherwise it overflowed.
 612        Sign equality is checked with a binary xor operation. */
 613     if ( ((Minuend ^ Subtrahend) < 0) && ((Minuend ^ Result) < 0) )
 614     {
 615         *pResult = LONGLONG_ERROR;
 616         return INTSAFE_E_ARITHMETIC_OVERFLOW;
 617     }
 618     else
 619     {
 620         *pResult = Result;
 621         return INTSAFE_SUCCESS;
 622     }
 623 }
 624
 625
 626 #define DEFINE_SAFE_SUB_S(_Name, _Type1, _Type2, _Convert) \
 627 _Must_inspect_result_ \
 628 __forceinline \
 629 INTSAFE_RESULT \
 630 INTSAFE_NAME(_Name)( \
 631     _In_ _Type1 Minuend, \
 632     _In_ _Type1 Subtrahend, \
 633     _Out_ _Deref_out_range_(==, Minuend - Subtrahend) _Type1* pOutput) \
 634 { \
 635     return INTSAFE_NAME(_Convert)(((_Type2)Minuend) - ((_Type2)Subtrahend), pOutput); \
 636 }
 637
 638 DEFINE_SAFE_SUB_S(LongSub, LONG, LONGLONG, LongLongToLong)
 639 #ifndef _WIN64
 640 DEFINE_SAFE_SUB_S(IntPtrSub, INT_PTR, LONGLONG, LongLongToIntPtr)
 641 DEFINE_SAFE_SUB_S(LongPtrSub, LONG_PTR, LONGLONG, LongLongToLongPtr)
 642 #endif
 643
 644
 645 _Must_inspect_result_
 646 __forceinline
 647 INTSAFE_RESULT
 648 INTSAFE_NAME(ULongLongMult)(
 649     _In_ ULONGLONG Multiplicand,
 650     _In_ ULONGLONG Multiplier,
 651     _Out_ _Deref_out_range_(==, Multiplicand * Multiplier) ULONGLONG* pOutput)
 652 {
 653     /* We can split the 64 bit numbers in low and high parts:
 654         M1 = M1Low + M1Hi * 0x100000000
 655         M2 = M2Low + M2Hi * 0x100000000
 656
 657        Then the multiplication looks like this:
 658         M1 * M2 = (M1Low + M1Hi * 0x100000000) * (M2Low + M2Hi * 0x100000000)
 659                 = M1Low * M2Low
 660                   + M1Low * M2Hi * 0x100000000
 661                   + M2Low * M1Hi * 0x100000000
 662                   + M1Hi * M2Hi * 0x100000000 * 0x100000000
 663
 664         We get an overflow when
 665             a) M1Hi * M2Hi != 0, so when M1Hi and M2Hi are both not 0
 666             b) The product of the nonzero high part and the other low part
 667                is larger than 32 bits.
 668             c) The addition of the product from b) shifted left by 32 and
 669                M1Low * M2Low is larger than 64 bits
 670     */
 671     ULONG M1Low = Multiplicand & 0xffffffff;
 672     ULONG M2Low = Multiplier & 0xffffffff;
 673     ULONG M1Hi = Multiplicand >> 32;
 674     ULONG M2Hi = Multiplier >> 32;
 675     ULONGLONG Temp;
 676
 677     if (M1Hi == 0)
 678     {
 679         Temp = UInt32x32To64(M1Low, M2Hi);
 680     }
 681     else if (M2Hi == 0)
 682     {
 683         Temp = UInt32x32To64(M1Hi, M2Low);
 684     }
 685     else
 686     {
 687         *pOutput = ULONGLONG_ERROR;
 688         return INTSAFE_E_ARITHMETIC_OVERFLOW;
 689     }
 690
 691     if (Temp > ULONG_MAX)
 692     {
 693         *pOutput = ULONGLONG_ERROR;
 694         return INTSAFE_E_ARITHMETIC_OVERFLOW;
 695     }
 696
 697     return INTSAFE_NAME(ULongLongAdd)(Temp << 32, UInt32x32To64(M1Low, M2Low), pOutput);
 698 }
 699
 700
 701 #define DEFINE_SAFE_MULT_U32(_Name, _Type, _Convert) \
 702 _Must_inspect_result_ \
 703 __forceinline \
 704 INTSAFE_RESULT \
 705 INTSAFE_NAME(_Name)( \
 706     _In_ _Type Multiplicand, \
 707     _In_ _Type Multiplier, \
 708     _Out_ _Deref_out_range_(==, Multiplicand * Multiplier) _Type* pOutput) \
 709 { \
 710     ULONGLONG Result = UInt32x32To64(Multiplicand, Multiplier); \
 711     return INTSAFE_NAME(_Convert)(Result, pOutput); \
 712 }
 713
 714 DEFINE_SAFE_MULT_U32(ULongMult, ULONG, ULongLongToULong)
 715 #ifndef _WIN64
 716 DEFINE_SAFE_MULT_U32(SizeTMult, size_t, ULongLongToSizeT)
 717 DEFINE_SAFE_MULT_U32(SIZETMult, SIZE_T, ULongLongToSIZET)
 718 #endif
 719
 720 #define DEFINE_SAFE_MULT_U16(_Name, _Type, _Convert) \
 721 _Must_inspect_result_ \
 722 __forceinline \
 723 INTSAFE_RESULT \
 724 INTSAFE_NAME(_Name)( \
 725     _In_ _Type Multiplicand, \
 726     _In_ _Type Multiplier, \
 727     _Out_ _Deref_out_range_(==, Multiplicand * Multiplier) _Type* pOutput) \
 728 { \
 729     ULONG Result = ((ULONG)Multiplicand) * ((ULONG)Multiplier); \
 730     return INTSAFE_NAME(_Convert)(Result, pOutput); \
 731 }
 732
 733 DEFINE_SAFE_MULT_U16(UShortMult, USHORT, ULongToUShort)
 734
 735
 736 #ifdef _NTINTSAFE_H_INCLUDED_
 737
 738 #define RtlUInt16Add RtlUShortAdd
 739 #define RtlWordAdd RtlUShortAdd
 740 #define RtlUInt32Add RtlUIntAdd
 741 #define RtlDWordAdd RtlULongAdd
 742 #define RtlDWordLongAdd RtlULongLongAdd
 743 #define RtlULong64Add RtlULongLongAdd
 744 #define RtlDWord64Add RtlULongLongAdd
 745 #define RtlUInt64Add RtlULongLongAdd
 746 #define RtlUInt16Sub RtlUShortSub
 747 #define RtlWordSub RtlUShortSub
 748 #define RtlUInt32Sub RtlUIntSub
 749 #define RtlDWordSub RtlULongSub
 750 #define RtlDWordLongSub RtlULongLongSub
 751 #define RtlULong64Sub RtlULongLongSub
 752 #define RtlDWord64Sub RtlULongLongSub
 753 #define RtlUInt64Sub RtlULongLongSub
 754 #define RtlUInt16Mult RtlUShortMult
 755 #define RtlWordMult RtlUShortMult
 756 #ifdef _WIN64
 757 #define RtlIntPtrSub RtlLongLongSub
 758 #define RtlLongPtrSub RtlLongLongSub
 759 #define RtlSizeTMult RtlULongLongMult
 760 #define RtlSIZETMult RtlULongLongMult
 761 #else
 762 #endif
 763
 764 #else // _NTINTSAFE_H_INCLUDED_
 765
 766 #define UInt16Add UShortAdd
 767 #define WordAdd UShortAdd
 768 #define UInt32Add UIntAdd
 769 #define DWordAdd ULongAdd
 770 #define DWordLongAdd ULongLongAdd
 771 #define ULong64Add ULongLongAdd
 772 #define DWord64Add ULongLongAdd
 773 #define UInt64Add ULongLongAdd
 774 #define UInt16Sub UShortSub
 775 #define WordSub UShortSub
 776 #define UInt32Sub UIntSub
 777 #define DWordSub ULongSub
 778 #define DWordLongSub ULongLongSub
 779 #define ULong64Sub ULongLongSub
 780 #define DWord64Sub ULongLongSub
 781 #define UInt64Sub ULongLongSub
 782 #define UInt16Mult UShortMult
 783 #define WordMult UShortMult
 784 #ifdef _WIN64
 785 #define IntPtrSub LongLongSub
 786 #define LongPtrSub LongLongSub
 787 #define SizeTMult ULongLongMult
 788 #define SIZETMult ULongLongMult
 789 #else
 790 #endif
 791
 792 #endif // _NTINTSAFE_H_INCLUDED_
 793
 794 #endif // !_INTSAFE_H_INCLUDED_