[PATCH 1/3] xalloc-oversized: export xalloc_count_t

[PATCH 1/3] xalloc-oversized: export xalloc_count_t

[Paul Eggert]

* lib/xalloc-oversized.h (__xalloc_oversized, xalloc_oversized):
* lib/xmalloca.h (nmalloca):
Comment re restrictions on arg types.
* lib/xalloc-oversized.h (xalloc_count_t): Rename from
__xalloc_count_type; all uses changed.  This publicizes the type.
---
 ChangeLog              |  9 +++++++++
 lib/malloca.h          |  1 +
 lib/xalloc-oversized.h | 24 ++++++++++++------------
 lib/xmalloca.h         |  3 ++-
 4 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index f3cca1ab2..0c3ea48fe 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2021-04-06  Paul Eggert  <eggert@cs.ucla.edu>
+
+	xalloc-oversized: export xalloc_count_t
+	* lib/xalloc-oversized.h (__xalloc_oversized, xalloc_oversized):
+	* lib/xmalloca.h (nmalloca):
+	Comment re restrictions on arg types.
+	* lib/xalloc-oversized.h (xalloc_count_t): Rename from
+	__xalloc_count_type; all uses changed.  This publicizes the type.
+
 2021-04-05  Paul Eggert  <eggert@cs.ucla.edu>
 
 	xalloc: try to pacify gcc -Wsign-compare
diff --git a/lib/malloca.h b/lib/malloca.h
index 017812d07..16a156ba2 100644
--- a/lib/malloca.h
+++ b/lib/malloca.h
@@ -77,6 +77,7 @@ extern void freea (void *p);
 /* nmalloca(N,S) is an overflow-safe variant of malloca (N * S).
    It allocates an array of N objects, each with S bytes of memory,
    on the stack.  S must be positive and N must be nonnegative.
+   Either N or S should be of type ptrdiff_t or size_t or wider.
    The array must be freed using freea() before the function returns.  */
 #define nmalloca(n, s) (xalloc_oversized (n, s) ? NULL : malloca ((n) * (s)))
 
diff --git a/lib/xalloc-oversized.h b/lib/xalloc-oversized.h
index 53daf5966..3618c75cb 100644
--- a/lib/xalloc-oversized.h
+++ b/lib/xalloc-oversized.h
@@ -21,34 +21,34 @@
 #include <stddef.h>
 #include <stdint.h>
 
-/* True if N * S would overflow in a size_t calculation,
-   or would generate a value larger than PTRDIFF_MAX.
+/* True if N * S does not fit into both ptrdiff_t and size_t.
+   S must be positive and N must be nonnegative.
    This expands to a constant expression if N and S are both constants.
-   By gnulib convention, SIZE_MAX represents overflow in size
+   By gnulib convention, SIZE_MAX represents overflow in size_t
    calculations, so the conservative size_t-based dividend to use here
    is SIZE_MAX - 1.  */
 #define __xalloc_oversized(n, s) \
   ((size_t) (PTRDIFF_MAX < SIZE_MAX ? PTRDIFF_MAX : SIZE_MAX - 1) / (s) < (n))
 
 #if PTRDIFF_MAX < SIZE_MAX
-typedef ptrdiff_t __xalloc_count_type;
+typedef ptrdiff_t xalloc_count_t;
 #else
-typedef size_t __xalloc_count_type;
+typedef size_t xalloc_count_t;
 #endif
 
-/* Return 1 if an array of N objects, each of size S, cannot exist
-   reliably due to size or ptrdiff_t arithmetic overflow.  S must be
-   positive and N must be nonnegative.  This is a macro, not a
-   function, so that it works correctly even when SIZE_MAX < N.  */
-
+/* Return 1 if an array of N objects, each of size S, cannot exist reliably
+   because its total size in bytes exceeds MIN (PTRDIFF_MAX, SIZE_MAX).
+   N must be nonnegative, S must be positive, and either N or S should be
+   of type ptrdiff_t or size_t or wider.  This is a macro, not a function,
+   so that it works even if an argument exceeds MAX (PTRDIFF_MAX, SIZE_MAX).  */
 #if 7 <= __GNUC__ && !defined __clang__
 # define xalloc_oversized(n, s) \
-   __builtin_mul_overflow_p (n, s, (__xalloc_count_type) 1)
+   __builtin_mul_overflow_p (n, s, (xalloc_count_t) 1)
 #elif 5 <= __GNUC__ && !defined __ICC && !__STRICT_ANSI__
 # define xalloc_oversized(n, s) \
    (__builtin_constant_p (n) && __builtin_constant_p (s) \
     ? __xalloc_oversized (n, s) \
-    : ({ __xalloc_count_type __xalloc_count; \
+    : ({ xalloc_count_t __xalloc_count; \
          __builtin_mul_overflow (n, s, &__xalloc_count); }))
 
 /* Other compilers use integer division; this may be slower but is
diff --git a/lib/xmalloca.h b/lib/xmalloca.h
index cbaa89d73..a87a336b6 100644
--- a/lib/xmalloca.h
+++ b/lib/xmalloca.h
@@ -45,7 +45,8 @@ extern void * xmmalloca (size_t n);
 
 /* xnmalloca(N,S) is an overflow-safe variant of xmalloca (N * S).
    It allocates an array of N objects, each with S bytes of memory,
-   on the stack.  S must be positive and N must be nonnegative.
+   on the stack.  S must be positive and N must be nonnegative,
+   and at least one of N and S should be ptrdiff_t or size_t or wider.
    The array must be freed using freea() before the function returns.
    Upon failure, it exits with an error message.  */
 #if HAVE_ALLOCA
-- 
2.27.0

[PATCH 2/3] backupfile: less-aggressive buffer growth

[Paul Eggert]

* lib/backupfile.c: Include intprops.h.
(numbered_backup): Grow buffer by the usual 50%, not 100%.
This is easier to do now that we have xalloc_count_t.
* modules/backup-rename, modules/backupfile: Depend on intprops.
---
 ChangeLog             | 6 ++++++
 lib/backupfile.c      | 6 ++++--
 modules/backup-rename | 1 +
 modules/backupfile    | 1 +
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 0c3ea48fe..c68da0df8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
 2021-04-06  Paul Eggert  <eggert@cs.ucla.edu>
 
+	backupfile: less-aggressive buffer growth
+	* lib/backupfile.c: Include intprops.h.
+	(numbered_backup): Grow buffer by the usual 50%, not 100%.
+	This is easier to do now that we have xalloc_count_t.
+	* modules/backup-rename, modules/backupfile: Depend on intprops.
+
 	xalloc-oversized: export xalloc_count_t
 	* lib/xalloc-oversized.h (__xalloc_oversized, xalloc_oversized):
 	* lib/xmalloca.h (nmalloca):
diff --git a/lib/backupfile.c b/lib/backupfile.c
index c53e3f335..1e427e8de 100644
--- a/lib/backupfile.c
+++ b/lib/backupfile.c
@@ -34,6 +34,7 @@
 #include "attribute.h"
 #include "basename-lgpl.h"
 #include "idx.h"
+#include "intprops.h"
 #include "opendirat.h"
 #include "renameatu.h"
 #include "xalloc-oversized.h"
@@ -270,8 +271,9 @@ numbered_backup (int dir_fd, char **buffer, size_t buffer_size, size_t filelen,
       size_t new_buffer_size = filelen + 2 + versionlenmax + 2;
       if (buffer_size < new_buffer_size)
         {
-          if (! xalloc_oversized (new_buffer_size, 2))
-            new_buffer_size *= 2;
+          xalloc_count_t grown;
+          if (! INT_ADD_WRAPV (new_buffer_size, new_buffer_size >> 1, &grown))
+            new_buffer_size = grown;
           char *new_buf = realloc (buf, new_buffer_size);
           if (!new_buf)
             {
diff --git a/modules/backup-rename b/modules/backup-rename
index 4497b3350..c50e874ff 100644
--- a/modules/backup-rename
+++ b/modules/backup-rename
@@ -17,6 +17,7 @@ closedir
 d-ino
 fcntl-h
 idx
+intprops
 memcmp
 opendirat
 readdir
diff --git a/modules/backupfile b/modules/backupfile
index 41cf99b02..42c8c9ed5 100644
--- a/modules/backupfile
+++ b/modules/backupfile
@@ -17,6 +17,7 @@ closedir
 d-ino
 fcntl-h
 idx
+intprops
 memcmp
 opendirat
 readdir
-- 
2.27.0

[PATCH 3/3] group-member: minor tweak to omit a *

[Paul Eggert]

* lib/group-member.c: Include intprops.h.
(get_group_info): Use INT_MULTIPLY_WRAPV instead of
xalloc_oversized (which does a multiplication) followed by the
same multiplication.  The code was OK as-is; this is just
conceptual simplification, possible now that we have xalloc_count_t.
* modules/group-member: Depend on intprops.
---
 ChangeLog            | 8 ++++++++
 lib/group-member.c   | 6 ++++--
 modules/group-member | 1 +
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index c68da0df8..46496bc75 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2021-04-06  Paul Eggert  <eggert@cs.ucla.edu>
 
+	group-member: minor tweak to omit a *
+	* lib/group-member.c: Include intprops.h.
+	(get_group_info): Use INT_MULTIPLY_WRAPV instead of
+	xalloc_oversized (which does a multiplication) followed by the
+	same multiplication.  The code was OK as-is; this is just
+	conceptual simplification, possible now that we have xalloc_count_t.
+	* modules/group-member: Depend on intprops.
+
 	backupfile: less-aggressive buffer growth
 	* lib/backupfile.c: Include intprops.h.
 	(numbered_backup): Grow buffer by the usual 50%, not 100%.
diff --git a/lib/group-member.c b/lib/group-member.c
index 52159016e..17bee831b 100644
--- a/lib/group-member.c
+++ b/lib/group-member.c
@@ -25,6 +25,7 @@
 #include <sys/types.h>
 #include <stdlib.h>
 
+#include "intprops.h"
 #include "xalloc-oversized.h"
 
 /* Most processes have no more than this many groups, and for these
@@ -53,10 +54,11 @@ get_group_info (struct group_info *gi)
   if (n_groups < 0)
     {
       int n_group_slots = getgroups (0, NULL);
+      xalloc_count_t nbytes;
       if (0 <= n_group_slots
-          && ! xalloc_oversized (n_group_slots, sizeof *gi->group))
+          && ! INT_MULTIPLY_WRAPV (n_group_slots, sizeof *gi->group, &nbytes))
         {
-          gi->group = malloc (n_group_slots * sizeof *gi->group);
+          gi->group = malloc (nbytes);
           if (gi->group)
             n_groups = getgroups (n_group_slots, gi->group);
         }
diff --git a/modules/group-member b/modules/group-member
index 1b743a33b..aa56ecf7e 100644
--- a/modules/group-member
+++ b/modules/group-member
@@ -9,6 +9,7 @@ Depends-on:
 unistd
 extensions
 getgroups        [test $HAVE_GROUP_MEMBER = 0]
+intprops         [test $HAVE_GROUP_MEMBER = 0]
 xalloc-oversized [test $HAVE_GROUP_MEMBER = 0]
 
 configure.ac:
-- 
2.27.0