summaryrefslogtreecommitdiff
path: root/usr.bin/vndcompress
AgeCommit message (Collapse)Author
2020-01-24Since vnconfig(8) was renamed (many years ago), update some cross-refspgoyette
in vndcompress(1) man page.
2017-07-29Clarify compile-time and run-time arithmetic safety assertions.riastradh
This is an experiment with a handful of macros for writing the checks, most of which are compile-time: MUL_OK(t, a, b) Does a*b avoid overflow in type t? ADD_OK(t, a, b) Does a + b avoid overflow in type t? TOOMANY(t, x, b, m) Are there more than m b-element blocks in x in type t? (I.e., does ceiling(x/b) > m?) Addenda that might make sense but are not needed here: MUL(t, a, b, &p) Set p = a*b and return 0, or return ERANGE if overflow. ADD(t, a, b, &s) Set s = a+b and return 0, or return ERANGE if overflow. Example: uint32_t a = ..., b = ..., y = ..., z = ..., x, w; /* input validation */ error = MUL(size_t, a, b, &x); if (error) fail; if (TOOMANY(uint32_t, x, BLKSIZ, MAX_NBLK)) fail; y = HOWMANY(x, BLKSIZ); if (z > Z_MAX) fail; ... /* internal computation */ __CTASSERT(MUL_OK(uint32_t, Z_MAX, MAX_NBLK)); w = z*y; Obvious shortcomings: 1. Nothing checks your ctassert matches your subsequent arithmetic. (Maybe we could have BOUNDED_MUL(t, x, xmax, y, ymax) with a ctassert inside.) 2. Nothing flows the bounds needed by the arithmetic you use back into candidate definitions of X_MAX/Y_MAX. But at least the reviewer's job is only to make sure that (a) the MUL_OK matches the *, and (b) the bounds in the assertion match the bounds on the inputs -- in particular, the reviewer need not derive the bounds from the context, only confirm they are supported by the paths to it. This is not meant to be a general-purpose proof assistant, or even a special-purpose one like gfverif <http://gfverif.cryptojedi.org/>. Rather, it is an experiment in adding a modicum of compile-time verification with a simple C API change. This also is not intended to serve as trapping arithmetic on overflow. The goal here is to enable writing the program with explicit checks on input and compile-time annotations on computation to gain confident that overflow won't happen in the computation.
2017-04-17Omit needless XXX comment.riastradh
2017-04-16Justify the last unjustified assertion here.riastradh
Sprinkle a few more assertions to help along the way. (Actually, it was justified; I just hadn't made explicit the relation to the value of fdpos that all two callers specify.)
2017-04-16Emphasize that MAX_WINDOW_SIZE is bounded by the maximum uint32_t.riastradh
Since we store window sizes in uint32_t, the maximum had better fit in uint32_t!
2017-03-21Simplify.riastradh
2017-01-10need <sys/stat.h>christos
2016-04-07__diagused, not __unused -- used in an assert.riastradh
2014-11-18Fix vndcompress restart failure fallback when input is a pipe.riastradh
Defer seeking the *input* image, or winding it forward, until we are certain we all ready in the cloop2 output, because when the input image is a pipe, we don't get a chance to seek back to the beginning and start from the top instead of restarting. If restart does fail, don't try to seek the input image back to the beginning unless we had already tried to seek or wind it forward. Add some automatic tests for this and related cases. XXX pullup to netbsd-7, netbsd-6
2014-01-25Get SIZE_MAX and OFF_MAX straight...riastradh
2014-01-25Factor out an offtab_compute_window_position routine.riastradh
2014-01-25Fix some more integer overflow/truncation issues.riastradh
Arithmetic in C is hard. Let's go shopping!
2014-01-24CID 1164169: integer overflowchristos
2014-01-23Mark offtab_bug[x] as dead.joerg
2014-01-22Fix $NetBSD$ tag.riastradh
2014-01-22Bump date on vndcompress(1) man page.riastradh
2014-01-22Fix vndcompress man page to reflect default window size.riastradh
2014-01-22Change vndcompress to use a default window size of 512.riastradh
For vnduncompress on nonseekable input, the window size is as large as it needs to be by default, as before. Not clear that this is the right choice -- by default vnduncompress on nonseekable input will just use unbounded memory unsolicited.
2014-01-22Document the new vndcompress -w option and nuke BUGS section.riastradh
Perhaps vndcompress and vnduncompress ought by default to choose a limited window size (say, 8192 entries, i.e. 64k bytes, the default MAXPHYS), and vnduncompress should fall back to an unlimited window only if the input is nonseekable.
2014-01-22Reflect rename of `-s' to `-b' in the vndcompress man page.riastradh
2014-01-22Move err1 & errx1 to the end of vnduncompress.c; add __printflike.riastradh
2014-01-22Rename block size option from `-s' to `-b'.riastradh
Makes more sense and makes it consistent with other utilities such as pax and pigz. This vndcompress has never gone out in a release, so changing the name of the option shouldn't cause too many problems...
2014-01-22Simplify vndcompress offtab_compute_window_size.riastradh
2014-01-22Fix typo in comment.riastradh
2014-01-22Fix up ulimited vndcompress tests and explain what's up with them.riastradh
2014-01-22Add some simple automatic tests for window sizes.riastradh
2014-01-22Remove silly comment in offtab_reset_write.riastradh
2014-01-22Window size is now an option; remove XXX comment to the contrary.riastradh
2014-01-22Add comment explaining why piperestart.cl2part is allowed to fail.riastradh
2014-01-22Split guard in offtab_write_window into offtab_maybe_write_window.riastradh
2014-01-22Seek if necessary at end of offtab_reset_read.riastradh
Fixes vnduncompress with a small window, and makes offtab_reset_read symmetric with offtab_reset_write.
2014-01-22Add option -w to vnd(un)compress to specify the window size.riastradh
2014-01-22Add some leading zero digits to the flags. Cosmetic change only.riastradh
2014-01-22Add WARNS=5.riastradh
2014-01-22Judicious (and justified) casts to avoid signed/unsigned comparisons.riastradh
2014-01-22Implement machinery for fixed-size windows into the offset table.riastradh
2014-01-22Write offsets in hexadecimal, not decimal.riastradh
2014-01-22Move block_signals/restore_sigmask to utils.criastradh
2014-01-22Use write-to-temporary/rename-to-permanent pattern in Makefile.riastradh
2014-01-22Abstract handling of the cloop2 offset table.riastradh
Preparation for converting it to use a fixed-size window.
2014-01-22Use read_block instead of read in vnduncompress.riastradh
2014-01-22Move vndcompress utilities to utils.c.riastradh
2014-01-22Fail if malloc can't allocate offset table.riastradh
2013-08-11Remove redundant WARNS=5.dholland
2013-05-06Make partial read/write error messages more consistent in vndcompress.riastradh
2013-05-04Add __printflike to vsnprintf_ss.riastradh
2013-05-04'unsigned long' prints with %lu, not %zu.riz
2013-05-04Add -l option to synopsis for vndcompress(1) man page.riastradh
2013-05-04Fix sign-compare in compress_blocks.riastradh
Not sure why my builds didn't reveal this one -- they revealed several others during development.
2013-05-04__printflike for vwarnx_ss, __dead for err_ss and errx_ss.joerg