chenlin/Mujoco_WASM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3120 from Ashutosh0x:fix/safe-overflow-msvc

Browse Source 
PiperOrigin-RevId: 923296001
Change-Id: I037dcc55c91d6eb68b3e63b34a0e059c796b5116
This commit is contained in:
Copybara-Service
2026-05-29 03:12:40 -07:00
parent df6942eb39 50ec8e84de
commit 9af965f241
2 changed files with 88 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/engine/engine_io.c
+26 -3
View File
@@ -185,9 +185,32 @@ static mjtSize safeAddToBufferSize(intptr_t* offset, mjtSize* nbuffer,
if (__builtin_add_overflow(*nbuffer, to_add, nbuffer)) return 0;
if (__builtin_add_overflow(*offset, to_add, offset)) return 0;
#else
// TODO: offer a safe implementation for MSVC or other compilers that don't have the builtins
*nbuffer += SKIP(*offset) + type_size*nr*nc;
*offset += SKIP(*offset) + type_size*nr*nc;
// safe overflow checks for MSVC and other compilers without __builtin_*_overflow
{
size_t product;
size_t to_add;
size_t skip = SKIP(*offset);
// nc * nr
if (nr > 0 && (size_t)nc > SIZE_MAX / (size_t)nr) return 0;
product = (size_t)nc * (size_t)nr;
// product * type_size
if (type_size > 0 && product > SIZE_MAX / type_size) return 0;
product *= type_size;
// product + SKIP(*offset)
if (product > SIZE_MAX - skip) return 0;
to_add = product + skip;
// *nbuffer + to_add
if ((size_t)*nbuffer > SIZE_MAX - to_add) return 0;
*nbuffer += to_add;
// *offset + to_add
if (*offset > 0 && to_add > (size_t)(INTPTR_MAX - *offset)) return 0;
*offset += to_add;
}
#endif
return 1;