From 5eb496b863da5b40dc5c9a713c8ca1e413811f35 Mon Sep 17 00:00:00 2001 From: Austin Eng Date: Wed, 24 Feb 2021 18:39:31 +0000 Subject: [PATCH] Add comment that memberLength for-loop cannot overflow Bug: dawn:680 Change-Id: I8e256fed58651ff8eb3d7a3f8b30d3b1ef0b3dcd Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/42400 Auto-Submit: Austin Eng Reviewed-by: Stephen White Reviewed-by: Corentin Wallez Commit-Queue: Corentin Wallez --- generator/templates/dawn_wire/WireCmd.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/generator/templates/dawn_wire/WireCmd.cpp b/generator/templates/dawn_wire/WireCmd.cpp index 4c1dead455..07c5e22484 100644 --- a/generator/templates/dawn_wire/WireCmd.cpp +++ b/generator/templates/dawn_wire/WireCmd.cpp @@ -270,6 +270,9 @@ namespace { {{member_transfer_type(member)}}* memberBuffer; SERIALIZE_TRY(buffer->NextN(memberLength, &memberBuffer)); + //* This loop cannot overflow because it iterates up to |memberLength|. Even if + //* memberLength were the maximum integer value, |i| would become equal to it just before + //* exiting the loop, but not increment past or wrap around. for (decltype(memberLength) i = 0; i < memberLength; ++i) { {{serialize_member(member, "record." + memberName + "[i]", "memberBuffer[i]" )}} } @@ -371,6 +374,9 @@ namespace { {% if member.annotation == "const*const*" %} {{as_cType(member.type.name)}}** pointerArray; DESERIALIZE_TRY(GetSpace(allocator, memberLength, &pointerArray)); + //* This loop cannot overflow because it iterates up to |memberLength|. Even if + //* memberLength were the maximum integer value, |i| would become equal to it just before + //* exiting the loop, but not increment past or wrap around. for (decltype(memberLength) i = 0; i < memberLength; ++i) { pointerArray[i] = &copiedMembers[i]; } @@ -379,6 +385,9 @@ namespace { record->{{memberName}} = copiedMembers; {% endif %} + //* This loop cannot overflow because it iterates up to |memberLength|. Even if + //* memberLength were the maximum integer value, |i| would become equal to it just before + //* exiting the loop, but not increment past or wrap around. for (decltype(memberLength) i = 0; i < memberLength; ++i) { {{deserialize_member(member, "memberBuffer[i]", "copiedMembers[i]")}} }