]>
Commit | Line | Data |
---|---|---|
db9ecf05 | 1 | /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
c2f1db8f | 2 | #pragma once |
60918275 | 3 | |
7e61bd0f | 4 | #include <assert.h> |
666a84ea | 5 | #include <errno.h> |
c31e1495 | 6 | #include <inttypes.h> |
c01ff965 | 7 | #include <stdbool.h> |
afc5dbf3 | 8 | #include <sys/param.h> |
27d13af7 | 9 | #include <sys/sysmacros.h> |
afc5dbf3 | 10 | #include <sys/types.h> |
60918275 | 11 | |
28db6fbf | 12 | #include "constants.h" |
e5bc5f1f YW |
13 | #include "macro-fundamental.h" |
14 | ||
026c2677 LP |
15 | /* Note: on GCC "no_sanitize_address" is a function attribute only, on llvm it may also be applied to global |
16 | * variables. We define a specific macro which knows this. Note that on GCC we don't need this decorator so much, since | |
17 | * our primary usecase for this attribute is registration structures placed in named ELF sections which shall not be | |
18 | * padded, but GCC doesn't pad those anyway if AddressSanitizer is enabled. */ | |
19 | #if HAS_FEATURE_ADDRESS_SANITIZER && defined(__clang__) | |
20 | #define _variable_no_sanitize_address_ __attribute__((__no_sanitize_address__)) | |
21 | #else | |
22 | #define _variable_no_sanitize_address_ | |
23 | #endif | |
24 | ||
8e2fa6e2 LP |
25 | /* Apparently there's no has_feature() call defined to check for ubsan, hence let's define this |
26 | * unconditionally on llvm */ | |
27 | #if defined(__clang__) | |
28 | #define _function_no_sanitize_float_cast_overflow_ __attribute__((no_sanitize("float-cast-overflow"))) | |
29 | #else | |
30 | #define _function_no_sanitize_float_cast_overflow_ | |
31 | #endif | |
32 | ||
7ebe131a | 33 | /* Temporarily disable some warnings */ |
4b6f74f5 ZJS |
34 | #define DISABLE_WARNING_DEPRECATED_DECLARATIONS \ |
35 | _Pragma("GCC diagnostic push"); \ | |
36 | _Pragma("GCC diagnostic ignored \"-Wdeprecated-declarations\"") | |
37 | ||
bcfce235 LP |
38 | #define DISABLE_WARNING_FORMAT_NONLITERAL \ |
39 | _Pragma("GCC diagnostic push"); \ | |
40 | _Pragma("GCC diagnostic ignored \"-Wformat-nonliteral\"") | |
41 | ||
f0f2e63b LP |
42 | #define DISABLE_WARNING_MISSING_PROTOTYPES \ |
43 | _Pragma("GCC diagnostic push"); \ | |
44 | _Pragma("GCC diagnostic ignored \"-Wmissing-prototypes\"") | |
45 | ||
8fca4e30 LP |
46 | #define DISABLE_WARNING_NONNULL \ |
47 | _Pragma("GCC diagnostic push"); \ | |
48 | _Pragma("GCC diagnostic ignored \"-Wnonnull\"") | |
49 | ||
d442e2ec DH |
50 | #define DISABLE_WARNING_SHADOW \ |
51 | _Pragma("GCC diagnostic push"); \ | |
52 | _Pragma("GCC diagnostic ignored \"-Wshadow\"") | |
53 | ||
df99a9ef ZJS |
54 | #define DISABLE_WARNING_INCOMPATIBLE_POINTER_TYPES \ |
55 | _Pragma("GCC diagnostic push"); \ | |
56 | _Pragma("GCC diagnostic ignored \"-Wincompatible-pointer-types\"") | |
57 | ||
6695c200 ZJS |
58 | #if HAVE_WSTRINGOP_TRUNCATION |
59 | # define DISABLE_WARNING_STRINGOP_TRUNCATION \ | |
60 | _Pragma("GCC diagnostic push"); \ | |
61 | _Pragma("GCC diagnostic ignored \"-Wstringop-truncation\"") | |
62 | #else | |
63 | # define DISABLE_WARNING_STRINGOP_TRUNCATION \ | |
64 | _Pragma("GCC diagnostic push") | |
65 | #endif | |
66 | ||
9c29d87b | 67 | #define DISABLE_WARNING_TYPE_LIMITS \ |
6028d766 LP |
68 | _Pragma("GCC diagnostic push"); \ |
69 | _Pragma("GCC diagnostic ignored \"-Wtype-limits\"") | |
70 | ||
9c29d87b YW |
71 | #define DISABLE_WARNING_ADDRESS \ |
72 | _Pragma("GCC diagnostic push"); \ | |
73 | _Pragma("GCC diagnostic ignored \"-Waddress\"") | |
74 | ||
7ebe131a LP |
75 | #define REENABLE_WARNING \ |
76 | _Pragma("GCC diagnostic pop") | |
77 | ||
49e5de64 ZJS |
78 | /* automake test harness */ |
79 | #define EXIT_TEST_SKIP 77 | |
80 | ||
13b498f9 TJ |
81 | /* builtins */ |
82 | #if __SIZEOF_INT__ == 4 | |
83 | #define BUILTIN_FFS_U32(x) __builtin_ffs(x); | |
84 | #elif __SIZEOF_LONG__ == 4 | |
85 | #define BUILTIN_FFS_U32(x) __builtin_ffsl(x); | |
86 | #else | |
87 | #error "neither int nor long are four bytes long?!?" | |
88 | #endif | |
89 | ||
625e870b DH |
90 | /* align to next higher power-of-2 (except for: 0 => 0, overflow => 0) */ |
91 | static inline unsigned long ALIGN_POWER2(unsigned long u) { | |
85c267af LP |
92 | |
93 | /* Avoid subtraction overflow */ | |
94 | if (u == 0) | |
95 | return 0; | |
96 | ||
625e870b DH |
97 | /* clz(0) is undefined */ |
98 | if (u == 1) | |
99 | return 1; | |
100 | ||
101 | /* left-shift overflow is undefined */ | |
102 | if (__builtin_clzl(u - 1UL) < 1) | |
103 | return 0; | |
104 | ||
105 | return 1UL << (sizeof(u) * 8 - __builtin_clzl(u - 1UL)); | |
106 | } | |
107 | ||
e49e4c33 LP |
108 | static inline size_t GREEDY_ALLOC_ROUND_UP(size_t l) { |
109 | size_t m; | |
110 | ||
111 | /* Round up allocation sizes a bit to some reasonable, likely larger value. This is supposed to be | |
112 | * used for cases which are likely called in an allocation loop of some form, i.e. that repetitively | |
113 | * grow stuff, for example strv_extend() and suchlike. | |
114 | * | |
115 | * Note the difference to GREEDY_REALLOC() here, as this helper operates on a single size value only, | |
116 | * and rounds up to next multiple of 2, needing no further counter. | |
117 | * | |
118 | * Note the benefits of direct ALIGN_POWER2() usage: type-safety for size_t, sane handling for very | |
119 | * small (i.e. <= 2) and safe handling for very large (i.e. > SSIZE_MAX) values. */ | |
120 | ||
121 | if (l <= 2) | |
122 | return 2; /* Never allocate less than 2 of something. */ | |
123 | ||
124 | m = ALIGN_POWER2(l); | |
125 | if (m == 0) /* overflow? */ | |
126 | return l; | |
127 | ||
128 | return m; | |
129 | } | |
130 | ||
bbc98d32 KS |
131 | /* |
132 | * container_of - cast a member of a structure out to the containing structure | |
133 | * @ptr: the pointer to the member. | |
134 | * @type: the type of the container struct this is embedded in. | |
135 | * @member: the name of the member within the struct. | |
bbc98d32 | 136 | */ |
fb835651 DH |
137 | #define container_of(ptr, type, member) __container_of(UNIQ, (ptr), type, member) |
138 | #define __container_of(uniq, ptr, type, member) \ | |
117efe06 | 139 | ({ \ |
fb835651 | 140 | const typeof( ((type*)0)->member ) *UNIQ_T(A, uniq) = (ptr); \ |
117efe06 | 141 | (type*)( (char *)UNIQ_T(A, uniq) - offsetof(type, member) ); \ |
fb835651 | 142 | }) |
bbc98d32 | 143 | |
d9fb7afb FB |
144 | #ifdef __COVERITY__ |
145 | ||
146 | /* Use special definitions of assertion macros in order to prevent | |
147 | * false positives of ASSERT_SIDE_EFFECT on Coverity static analyzer | |
148 | * for uses of assert_se() and assert_return(). | |
149 | * | |
150 | * These definitions make expression go through a (trivial) function | |
151 | * call to ensure they are not discarded. Also use ! or !! to ensure | |
152 | * the boolean expressions are seen as such. | |
153 | * | |
154 | * This technique has been described and recommended in: | |
155 | * https://community.synopsys.com/s/question/0D534000046Yuzb/suppressing-assertsideeffect-for-functions-that-allow-for-sideeffects | |
156 | */ | |
157 | ||
158 | extern void __coverity_panic__(void); | |
159 | ||
065a74a7 FS |
160 | static inline void __coverity_check__(int condition) { |
161 | if (!condition) | |
162 | __coverity_panic__(); | |
163 | } | |
164 | ||
165 | static inline int __coverity_check_and_return__(int condition) { | |
d9fb7afb FB |
166 | return condition; |
167 | } | |
168 | ||
065a74a7 | 169 | #define assert_message_se(expr, message) __coverity_check__(!!(expr)) |
d9fb7afb | 170 | |
065a74a7 | 171 | #define assert_log(expr, message) __coverity_check_and_return__(!!(expr)) |
d9fb7afb FB |
172 | |
173 | #else /* ! __COVERITY__ */ | |
174 | ||
34c38d2a | 175 | #define assert_message_se(expr, message) \ |
dd8f71ee | 176 | do { \ |
93a46b0b | 177 | if (_unlikely_(!(expr))) \ |
5a9b9157 | 178 | log_assert_failed(message, PROJECT_FILE, __LINE__, __func__); \ |
34c38d2a MS |
179 | } while (false) |
180 | ||
d9fb7afb FB |
181 | #define assert_log(expr, message) ((_likely_(expr)) \ |
182 | ? (true) \ | |
5a9b9157 | 183 | : (log_assert_failed_return(message, PROJECT_FILE, __LINE__, __func__), false)) |
d9fb7afb FB |
184 | |
185 | #endif /* __COVERITY__ */ | |
186 | ||
34c38d2a | 187 | #define assert_se(expr) assert_message_se(expr, #expr) |
dd8f71ee LP |
188 | |
189 | /* We override the glibc assert() here. */ | |
190 | #undef assert | |
191 | #ifdef NDEBUG | |
9ed794a3 | 192 | #define assert(expr) do {} while (false) |
dd8f71ee | 193 | #else |
34c38d2a | 194 | #define assert(expr) assert_message_se(expr, #expr) |
dd8f71ee | 195 | #endif |
60918275 | 196 | |
04499a70 | 197 | #define assert_not_reached() \ |
5a9b9157 | 198 | log_assert_failed_unreachable(PROJECT_FILE, __LINE__, __func__) |
60918275 | 199 | |
80514f9c LP |
200 | #define assert_return(expr, r) \ |
201 | do { \ | |
34c38d2a | 202 | if (!assert_log(expr, #expr)) \ |
80514f9c | 203 | return (r); \ |
18387b59 LP |
204 | } while (false) |
205 | ||
aa029628 TG |
206 | #define assert_return_errno(expr, r, err) \ |
207 | do { \ | |
34c38d2a | 208 | if (!assert_log(expr, #expr)) { \ |
aa029628 TG |
209 | errno = err; \ |
210 | return (r); \ | |
211 | } \ | |
212 | } while (false) | |
213 | ||
fd05c424 YW |
214 | #define return_with_errno(r, err) \ |
215 | do { \ | |
216 | errno = abs(err); \ | |
217 | return r; \ | |
218 | } while (false) | |
219 | ||
a3dc3547 KS |
220 | #define PTR_TO_INT(p) ((int) ((intptr_t) (p))) |
221 | #define INT_TO_PTR(u) ((void *) ((intptr_t) (u))) | |
14cb109d | 222 | #define PTR_TO_UINT(p) ((unsigned) ((uintptr_t) (p))) |
a3dc3547 | 223 | #define UINT_TO_PTR(u) ((void *) ((uintptr_t) (u))) |
60918275 | 224 | |
a3dc3547 KS |
225 | #define PTR_TO_LONG(p) ((long) ((intptr_t) (p))) |
226 | #define LONG_TO_PTR(u) ((void *) ((intptr_t) (u))) | |
c6c18be3 | 227 | #define PTR_TO_ULONG(p) ((unsigned long) ((uintptr_t) (p))) |
a3dc3547 | 228 | #define ULONG_TO_PTR(u) ((void *) ((uintptr_t) (u))) |
c6c18be3 | 229 | |
4081756a YW |
230 | #define PTR_TO_UINT8(p) ((uint8_t) ((uintptr_t) (p))) |
231 | #define UINT8_TO_PTR(u) ((void *) ((uintptr_t) (u))) | |
232 | ||
a3dc3547 KS |
233 | #define PTR_TO_INT32(p) ((int32_t) ((intptr_t) (p))) |
234 | #define INT32_TO_PTR(u) ((void *) ((intptr_t) (u))) | |
235 | #define PTR_TO_UINT32(p) ((uint32_t) ((uintptr_t) (p))) | |
236 | #define UINT32_TO_PTR(u) ((void *) ((uintptr_t) (u))) | |
60918275 | 237 | |
a3dc3547 KS |
238 | #define PTR_TO_INT64(p) ((int64_t) ((intptr_t) (p))) |
239 | #define INT64_TO_PTR(u) ((void *) ((intptr_t) (u))) | |
240 | #define PTR_TO_UINT64(p) ((uint64_t) ((uintptr_t) (p))) | |
241 | #define UINT64_TO_PTR(u) ((void *) ((uintptr_t) (u))) | |
c6c18be3 | 242 | |
74b2466e LP |
243 | #define PTR_TO_SIZE(p) ((size_t) ((uintptr_t) (p))) |
244 | #define SIZE_TO_PTR(u) ((void *) ((uintptr_t) (u))) | |
245 | ||
a9c55a88 LP |
246 | #define CHAR_TO_STR(x) ((char[2]) { x, 0 }) |
247 | ||
034c6ed7 LP |
248 | #define char_array_0(x) x[sizeof(x)-1] = 0; |
249 | ||
aaec2d7b | 250 | #define sizeof_field(struct_type, member) sizeof(((struct_type *) 0)->member) |
d6e9e8c7 | 251 | #define endoffsetof_field(struct_type, member) (offsetof(struct_type, member) + sizeof_field(struct_type, member)) |
aaec2d7b | 252 | |
56da8d5a LP |
253 | /* Returns the number of chars needed to format variables of the specified type as a decimal string. Adds in |
254 | * extra space for a negative '-' prefix for signed types. Includes space for the trailing NUL. */ | |
fa70beaa | 255 | #define DECIMAL_STR_MAX(type) \ |
56da8d5a LP |
256 | ((size_t) IS_SIGNED_INTEGER_TYPE(type) + 1U + \ |
257 | (sizeof(type) <= 1 ? 3U : \ | |
d3e40294 ZJS |
258 | sizeof(type) <= 2 ? 5U : \ |
259 | sizeof(type) <= 4 ? 10U : \ | |
56da8d5a | 260 | sizeof(type) <= 8 ? (IS_SIGNED_INTEGER_TYPE(type) ? 19U : 20U) : sizeof(int[-2*(sizeof(type) > 8)]))) |
fa70beaa | 261 | |
92463840 LP |
262 | /* Returns the number of chars needed to format the specified integer value. It's hence more specific than |
263 | * DECIMAL_STR_MAX() which answers the same question for all possible values of the specified type. Does | |
264 | * *not* include space for a trailing NUL. (If you wonder why we special case _x_ == 0 here: it's to trick | |
265 | * out gcc's -Wtype-limits, which would complain on comparing an unsigned type with < 0, otherwise. By | |
266 | * special-casing == 0 here first, we can use <= 0 instead of < 0 to trick out gcc.) */ | |
e3dd9ea8 FS |
267 | #define DECIMAL_STR_WIDTH(x) \ |
268 | ({ \ | |
269 | typeof(x) _x_ = (x); \ | |
92463840 LP |
270 | size_t ans; \ |
271 | if (_x_ == 0) \ | |
272 | ans = 1; \ | |
273 | else { \ | |
274 | ans = _x_ <= 0 ? 2 : 1; \ | |
275 | while ((_x_ /= 10) != 0) \ | |
276 | ans++; \ | |
277 | } \ | |
e3dd9ea8 | 278 | ans; \ |
0d1dbeb3 LP |
279 | }) |
280 | ||
35aa04e9 LP |
281 | #define SWAP_TWO(x, y) do { \ |
282 | typeof(x) _t = (x); \ | |
283 | (x) = (y); \ | |
284 | (y) = (_t); \ | |
285 | } while (false) | |
286 | ||
46bf625a ZJS |
287 | #define STRV_MAKE(...) ((char**) ((const char*[]) { __VA_ARGS__, NULL })) |
288 | #define STRV_MAKE_EMPTY ((char*[1]) { NULL }) | |
8b8024f1 | 289 | #define STRV_MAKE_CONST(...) ((const char* const*) ((const char*[]) { __VA_ARGS__, NULL })) |
46bf625a | 290 | |
66032ef4 LP |
291 | /* Pointers range from NULL to POINTER_MAX */ |
292 | #define POINTER_MAX ((void*) UINTPTR_MAX) | |
293 | ||
294 | /* Iterates through a specified list of pointers. Accepts NULL pointers, but uses POINTER_MAX as internal marker for EOL. */ | |
295 | #define FOREACH_POINTER(p, x, ...) \ | |
296 | for (typeof(p) *_l = (typeof(p)[]) { ({ p = x; }), ##__VA_ARGS__, POINTER_MAX }; \ | |
297 | p != (typeof(p)) POINTER_MAX; \ | |
1146b664 LP |
298 | p = *(++_l)) |
299 | ||
919ce0b7 SL |
300 | /* Define C11 thread_local attribute even on older gcc compiler |
301 | * version */ | |
ec202eae SL |
302 | #ifndef thread_local |
303 | /* | |
304 | * Don't break on glibc < 2.16 that doesn't define __STDC_NO_THREADS__ | |
85fce6f4 | 305 | * see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53769 |
ec202eae SL |
306 | */ |
307 | #if __STDC_VERSION__ >= 201112L && !(defined(__STDC_NO_THREADS__) || (defined(__GNU_LIBRARY__) && __GLIBC__ == 2 && __GLIBC_MINOR__ < 16)) | |
308 | #define thread_local _Thread_local | |
309 | #else | |
310 | #define thread_local __thread | |
311 | #endif | |
312 | #endif | |
cabb7806 | 313 | |
1e26b1df YW |
314 | #define DEFINE_TRIVIAL_DESTRUCTOR(name, type, func) \ |
315 | static inline void name(type *p) { \ | |
316 | func(p); \ | |
317 | } | |
318 | ||
fd421c4a | 319 | /* When func() returns the void value (NULL, -1, …) of the appropriate type */ |
a2341f68 ZJS |
320 | #define DEFINE_TRIVIAL_CLEANUP_FUNC(type, func) \ |
321 | static inline void func##p(type *p) { \ | |
322 | if (*p) \ | |
fd421c4a ZJS |
323 | *p = func(*p); \ |
324 | } | |
325 | ||
9c29d87b YW |
326 | /* When func() doesn't return the appropriate type, set variable to empty afterwards. |
327 | * The func() may be provided by a dynamically loaded shared library, hence add an assertion. */ | |
fd421c4a ZJS |
328 | #define DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(type, func, empty) \ |
329 | static inline void func##p(type *p) { \ | |
330 | if (*p != (empty)) { \ | |
9c29d87b YW |
331 | DISABLE_WARNING_ADDRESS; \ |
332 | assert(func); \ | |
333 | REENABLE_WARNING; \ | |
a2341f68 | 334 | func(*p); \ |
fd421c4a ZJS |
335 | *p = (empty); \ |
336 | } \ | |
f6a8265b | 337 | } |
a2341f68 | 338 | |
a6a08596 YW |
339 | #define _DEFINE_TRIVIAL_REF_FUNC(type, name, scope) \ |
340 | scope type *name##_ref(type *p) { \ | |
341 | if (!p) \ | |
342 | return NULL; \ | |
343 | \ | |
c8431e9e YW |
344 | /* For type check. */ \ |
345 | unsigned *q = &p->n_ref; \ | |
346 | assert(*q > 0); \ | |
7d3e856e | 347 | assert_se(*q < UINT_MAX); \ |
c8431e9e YW |
348 | \ |
349 | (*q)++; \ | |
a6a08596 YW |
350 | return p; \ |
351 | } | |
352 | ||
353 | #define _DEFINE_TRIVIAL_UNREF_FUNC(type, name, free_func, scope) \ | |
354 | scope type *name##_unref(type *p) { \ | |
355 | if (!p) \ | |
356 | return NULL; \ | |
357 | \ | |
358 | assert(p->n_ref > 0); \ | |
359 | p->n_ref--; \ | |
360 | if (p->n_ref > 0) \ | |
361 | return NULL; \ | |
362 | \ | |
363 | return free_func(p); \ | |
364 | } | |
365 | ||
366 | #define DEFINE_TRIVIAL_REF_FUNC(type, name) \ | |
367 | _DEFINE_TRIVIAL_REF_FUNC(type, name,) | |
368 | #define DEFINE_PRIVATE_TRIVIAL_REF_FUNC(type, name) \ | |
369 | _DEFINE_TRIVIAL_REF_FUNC(type, name, static) | |
370 | #define DEFINE_PUBLIC_TRIVIAL_REF_FUNC(type, name) \ | |
371 | _DEFINE_TRIVIAL_REF_FUNC(type, name, _public_) | |
372 | ||
373 | #define DEFINE_TRIVIAL_UNREF_FUNC(type, name, free_func) \ | |
374 | _DEFINE_TRIVIAL_UNREF_FUNC(type, name, free_func,) | |
375 | #define DEFINE_PRIVATE_TRIVIAL_UNREF_FUNC(type, name, free_func) \ | |
376 | _DEFINE_TRIVIAL_UNREF_FUNC(type, name, free_func, static) | |
377 | #define DEFINE_PUBLIC_TRIVIAL_UNREF_FUNC(type, name, free_func) \ | |
378 | _DEFINE_TRIVIAL_UNREF_FUNC(type, name, free_func, _public_) | |
379 | ||
380 | #define DEFINE_TRIVIAL_REF_UNREF_FUNC(type, name, free_func) \ | |
381 | DEFINE_TRIVIAL_REF_FUNC(type, name); \ | |
382 | DEFINE_TRIVIAL_UNREF_FUNC(type, name, free_func); | |
383 | ||
384 | #define DEFINE_PRIVATE_TRIVIAL_REF_UNREF_FUNC(type, name, free_func) \ | |
385 | DEFINE_PRIVATE_TRIVIAL_REF_FUNC(type, name); \ | |
386 | DEFINE_PRIVATE_TRIVIAL_UNREF_FUNC(type, name, free_func); | |
387 | ||
388 | #define DEFINE_PUBLIC_TRIVIAL_REF_UNREF_FUNC(type, name, free_func) \ | |
389 | DEFINE_PUBLIC_TRIVIAL_REF_FUNC(type, name); \ | |
390 | DEFINE_PUBLIC_TRIVIAL_UNREF_FUNC(type, name, free_func); | |
391 | ||
ed50f18c LP |
392 | /* A macro to force copying of a variable from memory. This is useful whenever we want to read something from |
393 | * memory and want to make sure the compiler won't optimize away the destination variable for us. It's not | |
394 | * supposed to be a full CPU memory barrier, i.e. CPU is still allowed to reorder the reads, but it is not | |
395 | * allowed to remove our local copies of the variables. We want this to work for unaligned memory, hence | |
396 | * memcpy() is great for our purposes. */ | |
397 | #define READ_NOW(x) \ | |
398 | ({ \ | |
399 | typeof(x) _copy; \ | |
400 | memcpy(&_copy, &(x), sizeof(_copy)); \ | |
401 | asm volatile ("" : : : "memory"); \ | |
402 | _copy; \ | |
403 | }) | |
404 | ||
8b0c4347 ZJS |
405 | #define saturate_add(x, y, limit) \ |
406 | ({ \ | |
407 | typeof(limit) _x = (x); \ | |
408 | typeof(limit) _y = (y); \ | |
409 | _x > (limit) || _y >= (limit) - _x ? (limit) : _x + _y; \ | |
410 | }) | |
411 | ||
b0e3d799 | 412 | static inline size_t size_add(size_t x, size_t y) { |
8b0c4347 | 413 | return saturate_add(x, y, SIZE_MAX); |
b0e3d799 | 414 | } |
7c502303 | 415 | |
3cc3dc77 MG |
416 | typedef struct { |
417 | int _empty[0]; | |
418 | } dummy_t; | |
419 | ||
420 | assert_cc(sizeof(dummy_t) == 0); | |
421 | ||
30fd9a2d | 422 | /* A little helper for subtracting 1 off a pointer in a safe UB-free way. This is intended to be used for |
50996f04 LP |
423 | * loops that count down from a high pointer until some base. A naive loop would implement this like this: |
424 | * | |
425 | * for (p = end-1; p >= base; p--) … | |
426 | * | |
427 | * But this is not safe because p before the base is UB in C. With this macro the loop becomes this instead: | |
428 | * | |
429 | * for (p = PTR_SUB1(end, base); p; p = PTR_SUB1(p, base)) … | |
430 | * | |
431 | * And is free from UB! */ | |
432 | #define PTR_SUB1(p, base) \ | |
433 | ({ \ | |
434 | typeof(p) _q = (p); \ | |
435 | _q && _q > (base) ? &_q[-1] : NULL; \ | |
436 | }) | |
437 | ||
dd8f71ee | 438 | #include "log.h" |