Clean up CPDF_AnnotList.
[pdfium.git] / third_party / base / numerics / safe_conversions_impl.h
1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #ifndef PDFIUM_THIRD_PARTY_BASE_SAFE_CONVERSIONS_IMPL_H_
6 #define PDFIUM_THIRD_PARTY_BASE_SAFE_CONVERSIONS_IMPL_H_
7
8 #include <assert.h>
9 #include <limits>
10
11 #include "../macros.h"
12 #include "../template_util.h"
13
14 namespace pdfium {
15 namespace base {
16 namespace internal {
17
18 // The std library doesn't provide a binary max_exponent for integers, however
19 // we can compute one by adding one to the number of non-sign bits. This allows
20 // for accurate range comparisons between floating point and integer types.
21 template <typename NumericType>
22 struct MaxExponent {
23   static const int value = std::numeric_limits<NumericType>::is_iec559
24                                ? std::numeric_limits<NumericType>::max_exponent
25                                : (sizeof(NumericType) * 8 + 1 -
26                                   std::numeric_limits<NumericType>::is_signed);
27 };
28
29 enum IntegerRepresentation {
30   INTEGER_REPRESENTATION_UNSIGNED,
31   INTEGER_REPRESENTATION_SIGNED
32 };
33
34 // A range for a given nunmeric Src type is contained for a given numeric Dst
35 // type if both numeric_limits<Src>::max() <= numeric_limits<Dst>::max() and
36 // numeric_limits<Src>::min() >= numeric_limits<Dst>::min() are true.
37 // We implement this as template specializations rather than simple static
38 // comparisons to ensure type correctness in our comparisons.
39 enum NumericRangeRepresentation {
40   NUMERIC_RANGE_NOT_CONTAINED,
41   NUMERIC_RANGE_CONTAINED
42 };
43
44 // Helper templates to statically determine if our destination type can contain
45 // maximum and minimum values represented by the source type.
46
47 template <
48     typename Dst,
49     typename Src,
50     IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed
51                                             ? INTEGER_REPRESENTATION_SIGNED
52                                             : INTEGER_REPRESENTATION_UNSIGNED,
53     IntegerRepresentation SrcSign =
54         std::numeric_limits<Src>::is_signed
55             ? INTEGER_REPRESENTATION_SIGNED
56             : INTEGER_REPRESENTATION_UNSIGNED >
57 struct StaticDstRangeRelationToSrcRange;
58
59 // Same sign: Dst is guaranteed to contain Src only if its range is equal or
60 // larger.
61 template <typename Dst, typename Src, IntegerRepresentation Sign>
62 struct StaticDstRangeRelationToSrcRange<Dst, Src, Sign, Sign> {
63   static const NumericRangeRepresentation value =
64       MaxExponent<Dst>::value >= MaxExponent<Src>::value
65           ? NUMERIC_RANGE_CONTAINED
66           : NUMERIC_RANGE_NOT_CONTAINED;
67 };
68
69 // Unsigned to signed: Dst is guaranteed to contain source only if its range is
70 // larger.
71 template <typename Dst, typename Src>
72 struct StaticDstRangeRelationToSrcRange<Dst,
73                                         Src,
74                                         INTEGER_REPRESENTATION_SIGNED,
75                                         INTEGER_REPRESENTATION_UNSIGNED> {
76   static const NumericRangeRepresentation value =
77       MaxExponent<Dst>::value > MaxExponent<Src>::value
78           ? NUMERIC_RANGE_CONTAINED
79           : NUMERIC_RANGE_NOT_CONTAINED;
80 };
81
82 // Signed to unsigned: Dst cannot be statically determined to contain Src.
83 template <typename Dst, typename Src>
84 struct StaticDstRangeRelationToSrcRange<Dst,
85                                         Src,
86                                         INTEGER_REPRESENTATION_UNSIGNED,
87                                         INTEGER_REPRESENTATION_SIGNED> {
88   static const NumericRangeRepresentation value = NUMERIC_RANGE_NOT_CONTAINED;
89 };
90
91 enum RangeConstraint {
92   RANGE_VALID = 0x0,  // Value can be represented by the destination type.
93   RANGE_UNDERFLOW = 0x1,  // Value would overflow.
94   RANGE_OVERFLOW = 0x2,  // Value would underflow.
95   RANGE_INVALID = RANGE_UNDERFLOW | RANGE_OVERFLOW  // Invalid (i.e. NaN).
96 };
97
98 // Helper function for coercing an int back to a RangeContraint.
99 inline RangeConstraint GetRangeConstraint(int integer_range_constraint) {
100   assert(integer_range_constraint >= RANGE_VALID &&
101          integer_range_constraint <= RANGE_INVALID);
102   return static_cast<RangeConstraint>(integer_range_constraint);
103 }
104
105 // This function creates a RangeConstraint from an upper and lower bound
106 // check by taking advantage of the fact that only NaN can be out of range in
107 // both directions at once.
108 inline RangeConstraint GetRangeConstraint(bool is_in_upper_bound,
109                                    bool is_in_lower_bound) {
110   return GetRangeConstraint((is_in_upper_bound ? 0 : RANGE_OVERFLOW) |
111                             (is_in_lower_bound ? 0 : RANGE_UNDERFLOW));
112 }
113
114 template <
115     typename Dst,
116     typename Src,
117     IntegerRepresentation DstSign = std::numeric_limits<Dst>::is_signed
118                                             ? INTEGER_REPRESENTATION_SIGNED
119                                             : INTEGER_REPRESENTATION_UNSIGNED,
120     IntegerRepresentation SrcSign = std::numeric_limits<Src>::is_signed
121                                             ? INTEGER_REPRESENTATION_SIGNED
122                                             : INTEGER_REPRESENTATION_UNSIGNED,
123     NumericRangeRepresentation DstRange =
124         StaticDstRangeRelationToSrcRange<Dst, Src>::value >
125 struct DstRangeRelationToSrcRangeImpl;
126
127 // The following templates are for ranges that must be verified at runtime. We
128 // split it into checks based on signedness to avoid confusing casts and
129 // compiler warnings on signed an unsigned comparisons.
130
131 // Dst range is statically determined to contain Src: Nothing to check.
132 template <typename Dst,
133           typename Src,
134           IntegerRepresentation DstSign,
135           IntegerRepresentation SrcSign>
136 struct DstRangeRelationToSrcRangeImpl<Dst,
137                                       Src,
138                                       DstSign,
139                                       SrcSign,
140                                       NUMERIC_RANGE_CONTAINED> {
141   static RangeConstraint Check(Src value) { return RANGE_VALID; }
142 };
143
144 // Signed to signed narrowing: Both the upper and lower boundaries may be
145 // exceeded.
146 template <typename Dst, typename Src>
147 struct DstRangeRelationToSrcRangeImpl<Dst,
148                                       Src,
149                                       INTEGER_REPRESENTATION_SIGNED,
150                                       INTEGER_REPRESENTATION_SIGNED,
151                                       NUMERIC_RANGE_NOT_CONTAINED> {
152   static RangeConstraint Check(Src value) {
153     return std::numeric_limits<Dst>::is_iec559
154                ? GetRangeConstraint(value <= std::numeric_limits<Dst>::max(),
155                                     value >= -std::numeric_limits<Dst>::max())
156                : GetRangeConstraint(value <= std::numeric_limits<Dst>::max(),
157                                     value >= std::numeric_limits<Dst>::min());
158   }
159 };
160
161 // Unsigned to unsigned narrowing: Only the upper boundary can be exceeded.
162 template <typename Dst, typename Src>
163 struct DstRangeRelationToSrcRangeImpl<Dst,
164                                       Src,
165                                       INTEGER_REPRESENTATION_UNSIGNED,
166                                       INTEGER_REPRESENTATION_UNSIGNED,
167                                       NUMERIC_RANGE_NOT_CONTAINED> {
168   static RangeConstraint Check(Src value) {
169     return GetRangeConstraint(value <= std::numeric_limits<Dst>::max(), true);
170   }
171 };
172
173 // Unsigned to signed: The upper boundary may be exceeded.
174 template <typename Dst, typename Src>
175 struct DstRangeRelationToSrcRangeImpl<Dst,
176                                       Src,
177                                       INTEGER_REPRESENTATION_SIGNED,
178                                       INTEGER_REPRESENTATION_UNSIGNED,
179                                       NUMERIC_RANGE_NOT_CONTAINED> {
180   static RangeConstraint Check(Src value) {
181     return sizeof(Dst) > sizeof(Src)
182                ? RANGE_VALID
183                : GetRangeConstraint(
184                      value <= static_cast<Src>(std::numeric_limits<Dst>::max()),
185                      true);
186   }
187 };
188
189 // Signed to unsigned: The upper boundary may be exceeded for a narrower Dst,
190 // and any negative value exceeds the lower boundary.
191 template <typename Dst, typename Src>
192 struct DstRangeRelationToSrcRangeImpl<Dst,
193                                       Src,
194                                       INTEGER_REPRESENTATION_UNSIGNED,
195                                       INTEGER_REPRESENTATION_SIGNED,
196                                       NUMERIC_RANGE_NOT_CONTAINED> {
197   static RangeConstraint Check(Src value) {
198     return (MaxExponent<Dst>::value >= MaxExponent<Src>::value)
199                ? GetRangeConstraint(true, value >= static_cast<Src>(0))
200                : GetRangeConstraint(
201                      value <= static_cast<Src>(std::numeric_limits<Dst>::max()),
202                      value >= static_cast<Src>(0));
203   }
204 };
205
206 template <typename Dst, typename Src>
207 inline RangeConstraint DstRangeRelationToSrcRange(Src value) {
208   COMPILE_ASSERT(std::numeric_limits<Src>::is_specialized,
209                  argument_must_be_numeric);
210   COMPILE_ASSERT(std::numeric_limits<Dst>::is_specialized,
211                  result_must_be_numeric);
212   return DstRangeRelationToSrcRangeImpl<Dst, Src>::Check(value);
213 }
214
215 }  // namespace internal
216 }  // namespace base
217 }  // namespace pdfium
218
219 #endif  // PDFIUM_THIRD_PARTY_BASE_SAFE_CONVERSIONS_IMPL_H_