On Fri, Aug 09, 2024 at 01:07:21AM +0300, Andy Shevchenko wrote: > On Fri, Aug 9, 2024 at 12:44 AM Justin Stitt <justinst...@google.com> wrote: > > > > When @size is 0, the desired behavior is to allow unlimited bytes to be > > parsed. Currently, this relies on some intentional arithmetic overflow > > where --size gives us SIZE_MAX when size is 0. > > > > Explicitly spell out the desired behavior without relying on intentional > > overflow/underflow. > > Hmm... but why? Overflow for the _unsigned_ types is okay. No?
Yes, it's well defined, but in trying to find a place to start making a meaningful impact on unexpected wrap-around, after discussions with Linus and Peter Zijlstra, we're going taking a stab at defining size_t as not expecting to wrap. Justin has been collecting false positive fixes while working on the compiler side of this, and I had asked him to send this one now since I think it additionally helps with readability. -- Kees Cook
