MdePkg/BaseSafeIntLib: fix undefined behavior in SafeInt64Sub()

The subtraction in the assignment

  SignedResult = Minuend - Subtrahend;

is performed with unchecked INT64 operands. According to ISO C, if the
mathematical result of signed integer subtraction cannot be represented in
the result type, the behavior is undefined. (Refer to ISO C99 6.5p5.
6.2.5p9 only exempts unsigned integers, and 6.3.1.3p3 does not apply
because it treats the conversion of integers that have been successfully
evaluated first.)

Replace the after-the-fact result checking with checks on the operands,
and only perform the subtraction if it is safe.

Cc: Bret Barkelew <Bret.Barkelew@microsoft.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Sean Brogan <sean.brogan@microsoft.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: Michael D Kinney <michael.d.kinney@intel.com>

diff --git a/MdePkg/Library/BaseSafeIntLib/SafeIntLib.c b/MdePkg/Library/BaseSafeIntLib/SafeIntLib.c
index d846160ba0d10550a9deba795bee9502632ef920..8e857927b0672e1b022ed9430ce1fe2dd07619c3 100644 (file)
--- a/MdePkg/Library/BaseSafeIntLib/SafeIntLib.c
+++ b/MdePkg/Library/BaseSafeIntLib/SafeIntLib.c
@@ -3837,27 +3837,55 @@ SafeInt64Sub (
   )\r
 {\r
   RETURN_STATUS  Status;\r
   )\r
 {\r
   RETURN_STATUS  Status;\r

-  INT64          SignedResult;\r

 \r
   if (Result == NULL) {\r
     return RETURN_INVALID_PARAMETER;\r
   }\r
 \r
 \r
   if (Result == NULL) {\r
     return RETURN_INVALID_PARAMETER;\r
   }\r
 \r

-  SignedResult = Minuend - Subtrahend;\r
-\r

   //\r
   //\r

-  // Subtracting a positive number from a positive number never overflows.\r
-  // Subtracting a negative number from a negative number never overflows.\r
-  // If you subtract a negative number from a positive number, you expect a positive result.\r
-  // If you subtract a positive number from a negative number, you expect a negative result.\r
-  // Overflow if inputs vary in sign and the output does not have the same sign as the first input.\r
+  // * A Subtrahend of zero can never cause underflow or overflow.\r
+  //\r
+  // * A positive Subtrahend can only cause underflow. The underflow condition\r
+  //   is:\r
+  //\r
+  //     (Minuend - Subtrahend) < MIN_INT64\r
+  //\r
+  //   Adding Subtrahend to both sides yields\r
+  //\r
+  //     Minuend < (MIN_INT64 + Subtrahend)\r
+  //\r
+  //   This condition can be coded directly in C because the RHS will neither\r
+  //   underflow nor overflow. That is due to the starting condition:\r
+  //\r
+  //     0 < Subtrahend <= MAX_INT64\r
+  //\r
+  //   Adding MIN_INT64 to all three sides yields\r
+  //\r
+  //     MIN_INT64 < (MIN_INT64 + Subtrahend) <= (MIN_INT64 + MAX_INT64) = -1\r

   //\r
   //\r

-  if (((Minuend < 0) != (Subtrahend < 0)) &&\r
-      ((Minuend < 0) != (SignedResult < 0))) {\r
+  // * A negative Subtrahend can only cause overflow. The overflow condition is\r
+  //\r
+  //     (Minuend - Subtrahend) > MAX_INT64\r
+  //\r
+  //   Adding Subtrahend to both sides yields\r
+  //\r
+  //     Minuend > (MAX_INT64 + Subtrahend)\r
+  //\r
+  //   This condition can be coded directly in C because the RHS will neither\r
+  //   underflow nor overflow. That is due to the starting condition:\r
+  //\r
+  //     MIN_INT64 <= Subtrahend < 0\r
+  //\r
+  //   Adding MAX_INT64 to all three sides yields\r
+  //\r
+  //     -1 = (MAX_INT64 + MIN_INT64) <= (MAX_INT64 + Subtrahend) < MAX_INT64\r
+  //\r
+  if (((Subtrahend > 0) && (Minuend < (MIN_INT64 + Subtrahend))) ||\r
+      ((Subtrahend < 0) && (Minuend > (MAX_INT64 + Subtrahend)))) {\r

     *Result = INT64_ERROR;\r
     Status = RETURN_BUFFER_TOO_SMALL;\r
   } else {\r
     *Result = INT64_ERROR;\r
     Status = RETURN_BUFFER_TOO_SMALL;\r
   } else {\r

-    *Result = SignedResult;\r
+    *Result = Minuend - Subtrahend;\r

     Status = RETURN_SUCCESS;\r
   }\r
 \r
     Status = RETURN_SUCCESS;\r
   }\r
 \r