c++ - gcc 会跳过这个有符号整数溢出检查吗？

Question

例如，给定以下代码:

int f(int n)
{
    if (n < 0)
        return 0;
    n = n + 100;
    if (n < 0)
        return 0;
    return n;
}

假设您传入一个非常接近整数溢出的数字(距离小于 100)，编译器会生成给您负返回的代码吗？

以下是 Simon Tatham 的“The Descent to C”中有关此问题的摘录:

"The GNU C compiler (gcc) generates code for this function which can return a negative integer, if you pass in (for example) the maximum represent able ‘int’ value. Because the compiler knows after the first if statement that n is positive, and then it assumes that integer overflow does not occur and uses that assumption to conclude that the value of n after the addition must still be positive, so it completely removes the second if statement and returns the result of the addition unchecked."

这让我想知道 C++ 编译器中是否存在同样的问题，我是否应该小心不要跳过我的整数溢出检查。

Answer 1

简答题

编译器是否一定会优化示例中的检查，我们不能说所有情况都适用，但我们可以使用 godbolt interactive compiler 对 gcc 4.9 进行测试。使用以下代码 ( see it live ):

int f(int n)
{
    if (n < 0) return 0;

    n = n + 100;

    if (n < 0) return 0;

    return n;
}

int f2(int n)
{
    if (n < 0) return 0;

    n = n + 100;

    return n;
}

我们看到它为两个版本生成相同的代码，这意味着它确实省略了第二次检查:

f(int):  
    leal    100(%rdi), %eax #, tmp88 
    testl   %edi, %edi  # n
    movl    $0, %edx    #, tmp89
    cmovs   %edx, %eax  # tmp88,, tmp89, D.2246
    ret
f2(int):
    leal    100(%rdi), %eax #, tmp88
    testl   %edi, %edi  # n
    movl    $0, %edx    #, tmp89 
    cmovs   %edx, %eax  # tmp88,, tmp89, D.2249
    ret

长答案

当您的代码显示 undefined behavior 时或者依赖于潜在的未定义行为(在此示例中有符号整数溢出)那么是的，编译器可以做出假设并围绕它们进行优化。例如，它可以假设没有未定义的行为，从而根据该假设进行优化。最臭名昭著的例子可能是 removal of a null check in the Linux kernel .代码如下:

struct foo *s = ...;
int x = s->f;
if (!s) return ERROR;
... use s ..

使用的逻辑是，由于 s 被取消引用，它不能是空指针，否则将是未定义的行为，因此它优化了 if (!s)查看。链接的文章说:

The problem is that the dereference of s in line 2 permits a compiler to infer that s is not null (if the pointer is null then the function is undefined; the compiler can simply ignore this case). Thus, the null check in line 3 gets silently optimized away and now the kernel contains an exploitable bug if an attacker can find a way to invoke this code with a null pointer.

这同样适用于 C 和 C++，它们在未定义行为方面都有相似的语言。在这两种情况下，标准都告诉我们未定义行为的结果是不可预测的，尽管两种语言中具体未定义的内容可能不同。 draft C++ standard定义未定义的行为如下:

behavior for which this International Standard imposes no requirements

并包括以下注释(强调我的):

Undefined behavior may be expected when this International Standard omits any explicit definition of behavior or when a program uses an erroneous construct or erroneous data. Permissible undefined behavior ranges from ignoring the situation completely with unpredictable results, to behaving during translation or program execution in a documented manner characteristic of the environment (with or without the issuance of a diagnostic message), to terminating a translation or execution (with the issuance of a diagnostic message). Many erroneous program constructs do not engender undefined behavior; they are required to be diagnosed.

C11 标准草案有类似的语言。

正确签名的溢出检查

您的检查不是防止有符号整数溢出的正确方法，您需要在执行操作之前进行检查，如果会导致溢出则不要执行操作。证书有一个 good reference关于如何防止各种操作的有符号整数溢出。对于加法案例，它建议如下:

#include <limits.h>

void f(signed int si_a, signed int si_b) {
  signed int sum;
  if (((si_b > 0) && (si_a > (INT_MAX - si_b))) ||
      ((si_b < 0) && (si_a < (INT_MIN - si_b)))) {
    /* Handle error */
  } else {
    sum = si_a + si_b;
  }

如果我们将这段代码插入到 Godbolt 中，我们可以看到检查被省略了，这是我们期望的行为。