Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87831
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain belski.net from 85.214.73.107 cause and error)
To: "'Sherif Ramadan'" <theanomaly.is@gmail.com>
Cc: "'Dmitry Stogov'" <dmitry@php.net>,
	"'Xinchen Hui'" <xinchen.h@zend.com>,
	"'Nikita Popov'" <nikita.ppv@gmail.com>,
	"'Pierre Joye'" <pierre.php@gmail.com>,
	"'Bob Weinand'" <bobwei9@hotmail.com>,
	"'Jakub Zelenka'" <bukka@php.net>,
	"'Matt Wilmas'" <php_lists@realplain.com>,
	"'PHP Internals'" <internals@lists.php.net>
References: <02a601d0dbed$2c828df0$8587a9d0$@belski.net> <CAL+t6cHdJNNySG0x76a1k_903XrFmfcCDHHH8LbmiTRNoQ3c4Q@mail.gmail.com>
In-Reply-To: <CAL+t6cHdJNNySG0x76a1k_903XrFmfcCDHHH8LbmiTRNoQ3c4Q@mail.gmail.com>
Date: Fri, 21 Aug 2015 11:37:30 +0200
Message-ID: <02ae01d0dbf5$01c17330$05445990$@belski.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQK9NdJN9egRUY1Umglkf8yuRLR3fgF0Y2w7nDHZQ1A=
Content-Language: en-us
Subject: RE: [PHP-DEV] Overflow checks and integral vars comparison
From: anatol.php@belski.net ("Anatol Belski")

Hi Sherif,

> -----Original Message-----
> From: Sherif Ramadan [mailto:theanomaly.is@gmail.com]
> Sent: Friday, August 21, 2015 11:21 AM
> To: Anatol Belski <anatol.php@belski.net>
> Cc: Dmitry Stogov <dmitry@php.net>; Xinchen Hui <xinchen.h@zend.com>;
> Nikita Popov <nikita.ppv@gmail.com>; Pierre Joye =
<pierre.php@gmail.com>;
> Bob Weinand <bobwei9@hotmail.com>; Jakub Zelenka <bukka@php.net>; Matt
> Wilmas <php_lists@realplain.com>; PHP Internals =
<internals@lists.php.net>
> Subject: Re: [PHP-DEV] Overflow checks and integral vars comparison
>=20
> Maybe I'm missing something here, but how do these macros detect =
overflow
> exactly? If the check is done on the actual result and not the =
operands then it's
> not a good overflow check. Additionally, why wouldn't overflow checks =
be
> needed on 32-bit architecture, or any other architecture for that =
matter?
> Integers can overflow there too.
>=20
Example code in simplexml_load_string()

    if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|C!lsb", &data, =
&data_len, &ce, &options, &ns, &ns_len, &isprefix) =3D=3D FAILURE) {
        return;
    }

    If (ZEND_LONG_INT_OVFL(options)) {
         RETURN_FALSE;
    }
    If (ZEND_SIZE_T_INT_OVFL(data_len)) {
         RETURN_FALSE;
    }
 =20
    docp =3D xmlReadMemory(data, data_len, NULL, NULL, options);


- on x86_64 - possible int overflow without check
- on ILP64 or i386 alike - no int overflow per se, so can be ommited

Regards

Anatol

> On Fri, Aug 21, 2015 at 4:41 AM, Anatol Belski <anatol.php@belski.net>
> wrote:
>=20
> > Hi,
> >
> > Resending this as missed internals at the start.
> >
> > I was lately rethinking some part of the 64-bit RFC, and also seeing
> > now Jakub's work on catching overflows in ext/openssl and Matt
> > Williams suggestions on it (which was going a bit more global over
> > it). So I came up with these macros with two goals
> >
> > - standardize the overflow checks
> > - do actualy checks only on architectures where it's needed
> > - simplify the checks where external libs (openssl, libxml, etc.) =
use
> > firm datatypes like int
> >
> > #if SIZEOF_INT =3D=3D SIZEOF_ZEND_LONG
> > # define ZEND_LONG_INT_OVFL(zl) (0)
> > # define ZEND_LONG_INT_UDFL(zl) (0)
> > #else
> > # define ZEND_LONG_INT_OVFL(zlong) ((zlong) > (zend_long)INT_MAX) #
> > define
> > ZEND_LONG_INT_UDFL(zlong) ((zlong) < (zend_long)INT_MIN) #endif
> >
> > #define ZEND_SIZE_T_INT_OVFL(size) ((size) > (size_t)INT_MAX)
> >
> > So having it like
> >
> > If (ZEND_LONG_INT_OVFL(x)) {
> >         return;
> > }
> >
> > Compiler would eliminate the branch automatically on 32-bit and =
ILP64.
> >
> > Some other macros to do signed/unsigned comparison, these can be
> extended.
> >
> > #define ZEND_SIZE_T_GT_ZEND_LONG(size, zlong) ((zlong) < 0 || (size) =
>
> > (size_t)(zlong)) #define ZEND_SIZE_T_GTE_ZEND_LONG(size, zlong)
> > ((zlong) <
> > 0
> > || (size) >=3D (size_t)(zlong)) #define =
ZEND_SIZE_T_LT_ZEND_LONG(size,
> > || zlong)
> > ((zlong) >=3D 0 && (size) < (size_t)(zlong)) #define
> > ZEND_SIZE_T_LTE_ZEND_LONG(size, zlong) ((zlong) >=3D 0 && (size) =
<=3D
> > (size_t)(zlong))
> >
> > IMHO these and maybe more are missing after the 64-bit RFC. Do you
> > think they would make sense? Or would make sense now, or later in =
master?
> >
> > Thanks
> >
> > Anatol
> >
> >
> > --
> > PHP Internals - PHP Runtime Development Mailing List To unsubscribe,
> > visit: http://www.php.net/unsub.php
> >
> >