Messages in this thread | | | Date | Wed, 31 Aug 2022 10:49:07 -0700 | From | Kees Cook <> | Subject | Re: [PATCH v3] overflow: Allow mixed type arguments |
| |
On Tue, Aug 30, 2022 at 09:52:32PM +0200, Rasmus Villemoes wrote: > On 30/08/2022 21.21, Kees Cook wrote: > > [...] > > + * *@d holds the results of the attempted addition, but is not considered > > + * "safe for use" on a non-zero return value, which indicates that the > > + * sum has overflowed or been truncated. > > I don't like that wording. It makes it sound like there's some ambiguity > or (implementation|un)-definedness involved in what the destination > holds on overflow. The gcc documentation is perfectly clear that the > result is the infinite-precision result truncated to N bits, with N > being the bitwidth of d.
Hm, well, I think use of *d should be strongly discouraged on overflow. How about just adding the specifics to the end?
* *@d holds the result of the attempted addition, but is not considered * "safe for use" on a non-zero return value, which indicates that the * sum has overflowed or been truncated. (*@d will contain the * infinite-precision result truncated to the bitwidth of *@d.)
-- Kees Cook
| |