fortify: use a macro in diagnose_if
Our diagnose_if conditions are repetitive. It's potentially convenient
to hide that behind a macro. There's an upcoming refactor to our
run-time checks; having static checks look super similar is convenient,
and makes correctness (hopefully) slightly more obvious.
Bug: 131861088
Test: checkbuild on internal master.
Change-Id: Ic39a3b6bf020734c1bef6be144f61ef81466aafe
diff --git a/libc/include/bits/fortify/poll.h b/libc/include/bits/fortify/poll.h
index 718ee96..0d9b927 100644
--- a/libc/include/bits/fortify/poll.h
+++ b/libc/include/bits/fortify/poll.h
@@ -40,8 +40,7 @@
__BIONIC_FORTIFY_INLINE
int poll(struct pollfd* const fds __pass_object_size, nfds_t fd_count, int timeout)
__overloadable
- __clang_error_if(__bos(fds) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
- __bos(fds) < sizeof(*fds) * fd_count,
+ __clang_error_if(__bos_unevaluated_lt(__bos(fds), sizeof(*fds) * fd_count),
"in call to 'poll', fd_count is larger than the given buffer") {
size_t bos_fds = __bos(fds);
@@ -54,8 +53,7 @@
__BIONIC_FORTIFY_INLINE
int ppoll(struct pollfd* const fds __pass_object_size, nfds_t fd_count, const struct timespec* timeout, const sigset_t* mask)
__overloadable
- __clang_error_if(__bos(fds) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
- __bos(fds) < sizeof(*fds) * fd_count,
+ __clang_error_if(__bos_unevaluated_lt(__bos(fds), sizeof(*fds) * fd_count),
"in call to 'ppoll', fd_count is larger than the given buffer") {
size_t bos_fds = __bos(fds);
@@ -69,8 +67,7 @@
__BIONIC_FORTIFY_INLINE
int ppoll64(struct pollfd* const fds __pass_object_size, nfds_t fd_count, const struct timespec* timeout, const sigset64_t* mask)
__overloadable
- __clang_error_if(__bos(fds) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
- __bos(fds) < sizeof(*fds) * fd_count,
+ __clang_error_if(__bos_unevaluated_lt(__bos(fds), sizeof(*fds) * fd_count),
"in call to 'ppoll64', fd_count is larger than the given buffer") {
size_t bos_fds = __bos(fds);
diff --git a/libc/include/bits/fortify/socket.h b/libc/include/bits/fortify/socket.h
index 3d070c5..c1a85c6 100644
--- a/libc/include/bits/fortify/socket.h
+++ b/libc/include/bits/fortify/socket.h
@@ -44,8 +44,7 @@
__BIONIC_FORTIFY_INLINE
ssize_t recvfrom(int fd, void* const buf __pass_object_size0, size_t len, int flags, struct sockaddr* src_addr, socklen_t* addr_len)
__overloadable
- __clang_error_if(__bos(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos(buf) < len,
- __recvfrom_bad_size) {
+ __clang_error_if(__bos_unevaluated_lt(__bos0(buf), len), __recvfrom_bad_size) {
size_t bos = __bos0(buf);
if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) {
@@ -59,8 +58,7 @@
__BIONIC_FORTIFY_INLINE
ssize_t sendto(int fd, const void* const buf __pass_object_size0, size_t len, int flags, const struct sockaddr* dest_addr, socklen_t addr_len)
__overloadable
- __clang_error_if(__bos0(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(buf) < len,
- __sendto_bad_size) {
+ __clang_error_if(__bos_unevaluated_lt(__bos0(buf), len), __sendto_bad_size) {
size_t bos = __bos0(buf);
if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) {
@@ -73,7 +71,7 @@
__BIONIC_FORTIFY_INLINE
ssize_t recv(int socket, void* const buf __pass_object_size0, size_t len, int flags)
__overloadable
- __clang_error_if(__bos0(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(buf) < len,
+ __clang_error_if(__bos_unevaluated_lt(__bos0(buf), len),
"'recv' called with size bigger than buffer") {
return recvfrom(socket, buf, len, flags, NULL, 0);
}
@@ -81,7 +79,7 @@
__BIONIC_FORTIFY_INLINE
ssize_t send(int socket, const void* const buf __pass_object_size0, size_t len, int flags)
__overloadable
- __clang_error_if(__bos0(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(buf) < len,
+ __clang_error_if(__bos_unevaluated_lt(__bos0(buf), len),
"'send' called with size bigger than buffer") {
return sendto(socket, buf, len, flags, NULL, 0);
}
diff --git a/libc/include/bits/fortify/stdio.h b/libc/include/bits/fortify/stdio.h
index 0b5700a..fc7d359 100644
--- a/libc/include/bits/fortify/stdio.h
+++ b/libc/include/bits/fortify/stdio.h
@@ -57,8 +57,7 @@
__BIONIC_ERROR_FUNCTION_VISIBILITY
int snprintf(char* dest, size_t size, const char* format)
__overloadable
- __enable_if(__bos(dest) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
- __bos(dest) < __builtin_strlen(format),
+ __enable_if(__bos_unevaluated_lt(__bos(dest), __builtin_strlen(format)),
"format string will always overflow destination buffer")
__errorattr("format string will always overflow destination buffer");
@@ -75,8 +74,7 @@
__BIONIC_ERROR_FUNCTION_VISIBILITY
int sprintf(char* dest, const char* format)
__overloadable
- __enable_if(__bos(dest) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
- __bos(dest) < __builtin_strlen(format),
+ __enable_if(__bos_unevaluated_lt(__bos(dest), __builtin_strlen(format)),
"format string will always overflow destination buffer")
__errorattr("format string will always overflow destination buffer");
@@ -96,7 +94,7 @@
__overloadable
__clang_error_if(__unsafe_check_mul_overflow(size, count),
"in call to 'fread', size * count overflows")
- __clang_error_if(__bos(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && size * count > __bos(buf),
+ __clang_error_if(__bos_unevaluated_lt(__bos0(buf), size * count),
"in call to 'fread', size * count is too large for the given buffer") {
size_t bos = __bos0(buf);
@@ -111,7 +109,7 @@
__overloadable
__clang_error_if(__unsafe_check_mul_overflow(size, count),
"in call to 'fwrite', size * count overflows")
- __clang_error_if(__bos(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && size * count > __bos(buf),
+ __clang_error_if(__bos_unevaluated_lt(__bos0(buf), size * count),
"in call to 'fwrite', size * count is too large for the given buffer") {
size_t bos = __bos0(buf);
@@ -128,7 +126,7 @@
char* fgets(char* const __pass_object_size dest, int size, FILE* stream)
__overloadable
__clang_error_if(size < 0, "in call to 'fgets', size should not be negative")
- __clang_error_if(size > __bos(dest),
+ __clang_error_if(__bos_unevaluated_lt(__bos(dest), size),
"in call to 'fgets', size is larger than the destination buffer") {
size_t bos = __bos(dest);
diff --git a/libc/include/bits/fortify/stdlib.h b/libc/include/bits/fortify/stdlib.h
index d47c0b0..eff909f 100644
--- a/libc/include/bits/fortify/stdlib.h
+++ b/libc/include/bits/fortify/stdlib.h
@@ -38,8 +38,8 @@
#define __PATH_MAX 4096
char* realpath(const char* path, char* resolved)
- __clang_error_if(__bos(resolved) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
- __bos(resolved) < __PATH_MAX, __realpath_buf_too_small_str)
+ __clang_error_if(__bos_unevaluated_lt(__bos(resolved), __PATH_MAX),
+ __realpath_buf_too_small_str)
__clang_error_if(!path, "'realpath': NULL path is never correct; flipped arguments?");
/* No need for a definition; the only issues we can catch are at compile-time. */
diff --git a/libc/include/bits/fortify/string.h b/libc/include/bits/fortify/string.h
index 14bb133..80eb43e 100644
--- a/libc/include/bits/fortify/string.h
+++ b/libc/include/bits/fortify/string.h
@@ -44,7 +44,7 @@
__BIONIC_FORTIFY_INLINE
void* memcpy(void* const dst __pass_object_size0, const void* src, size_t copy_amount)
__overloadable
- __clang_error_if(__bos0(dst) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(dst) < copy_amount,
+ __clang_error_if(__bos_unevaluated_lt(__bos0(dst), copy_amount),
"'memcpy' called with size bigger than buffer") {
return __builtin___memcpy_chk(dst, src, copy_amount, __bos0(dst));
}
@@ -52,7 +52,7 @@
__BIONIC_FORTIFY_INLINE
void* memmove(void* const dst __pass_object_size0, const void* src, size_t len)
__overloadable
- __clang_error_if(__bos0(dst) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(dst) < len,
+ __clang_error_if(__bos_unevaluated_lt(__bos0(dst), len),
"'memmove' called with size bigger than buffer") {
return __builtin___memmove_chk(dst, src, len, __bos0(dst));
}
@@ -62,8 +62,7 @@
__BIONIC_FORTIFY_INLINE
char* stpcpy(char* const dst __pass_object_size, const char* src)
__overloadable
- __clang_error_if(__bos(dst) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
- __bos(dst) <= __builtin_strlen(src),
+ __clang_error_if(__bos_unevaluated_leq(__bos(dst), __builtin_strlen(src)),
"'stpcpy' called with string bigger than buffer") {
return __builtin___stpcpy_chk(dst, src, __bos(dst));
}
@@ -73,8 +72,7 @@
__BIONIC_FORTIFY_INLINE
char* strcpy(char* const dst __pass_object_size, const char* src)
__overloadable
- __clang_error_if(__bos(dst) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
- __bos(dst) <= __builtin_strlen(src),
+ __clang_error_if(__bos_unevaluated_leq(__bos(dst), __builtin_strlen(src)),
"'strcpy' called with string bigger than buffer") {
return __builtin___strcpy_chk(dst, src, __bos(dst));
}
@@ -92,7 +90,7 @@
__BIONIC_FORTIFY_INLINE
void* memset(void* const s __pass_object_size0, int c, size_t n)
__overloadable
- __clang_error_if(__bos0(s) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(s) < n,
+ __clang_error_if(__bos_unevaluated_lt(__bos0(s), n),
"'memset' called with size bigger than buffer")
/* If you're a user who wants this warning to go away: use `(&memset)(foo, bar, baz)`. */
__clang_warning_if(c && !n, "'memset' will set 0 bytes; maybe the arguments got flipped?") {
diff --git a/libc/include/bits/fortify/unistd.h b/libc/include/bits/fortify/unistd.h
index a07907b..04c7495 100644
--- a/libc/include/bits/fortify/unistd.h
+++ b/libc/include/bits/fortify/unistd.h
@@ -63,7 +63,7 @@
__clang_error_if((what) > SSIZE_MAX, "in call to '" #fn "', '" #what "' must be <= SSIZE_MAX")
#define __error_if_overflows_objectsize(what, objsize, fn) \
- __clang_error_if((objsize) != __BIONIC_FORTIFY_UNKNOWN_SIZE && (what) > (objsize), \
+ __clang_error_if(__bos_unevaluated_lt((objsize), (what)), \
"in call to '" #fn "', '" #what "' bytes overflows the given object")
#if __ANDROID_API__ >= __ANDROID_API_N__