Messages in this thread | | | Date | Wed, 26 Nov 2014 13:50:14 -0500 | From | Sasha Levin <> | Subject | Re: [RFC 1/2] compiler: use compiler to detect integer overflows |
| |
On 11/26/2014 12:55 PM, Linus Torvalds wrote: > On Nov 26, 2014 6:00 AM, "Sasha Levin" <sasha.levin@oracle.com <mailto:sasha.levin@oracle.com>> wrote: >> >> We've used to detect integer overflows by causing an overflow and testing the >> result. For example, to test for addition overflow we would: >> >> if (a + b < a) >> /* Overflow detected */ >> >> While it works, this is actually an undefined behaviour and we're not >> guaranteed to have integers overflowing this way. > > Bullshit. > > Integer overflow is completely well defined in unsigned types. > > Don't make up things like this.
Yes, I messed up and picked case where both types are unsigned in my example patch. Apologies.
The kernel still has it's share of *signed* integer overflows. Example? fadvise64_64():
loff_t offset, len; [...] loff_t endbyte; [...] /* Careful about overflows. Len == 0 means "as much as possible" */ endbyte = offset + len; if (!len || endbyte < len) endbyte = -1; else endbyte--; /* inclusive */
In essence, it's checking (offset + len < len), all of which are signed.
Thanks, Sasha
| |