On Mon, Oct 12, 2026 at 8:30 PM Kees Cook <[email protected]> wrote: > > On Mon, Oct 12, 2026 at 08:59:19PM +0000, Bill Wendling wrote: > > The two parts of the '__builtin_choose_expr()' had different arithmetic > > expressions. This patch correct it so that both parts calculate: > > > > COUNT * sizeof(*MEMBER) + __must_be_array(MEMBER) > > > > In practice, the call to '__must_be_array' is meant to assert if > > 'MEMBER' isn't an array and return '0' otherwise. However, symmetry is > > less prone to subtle errors (and far more satisfying). > > > > Fixes: 230f6fa2c1db ("overflow: Provide constant expression struct_size") > > A Fixes trailer implies a bug being solved. What problem is there here? > I only see downsides to this change: this adds even more layers of > macros and inlinings to gain the size_add() for a constant integer 0. > > ? > I wasn't sure about the Fixes, sorry about that. Why not put the "+ __must_be_array" stuff outside of the `size_mul` instead, since it's only there to catch an error? So something like
(__builtin_choose_expr(<pred>, <true>, <false>) + __must_be_array(...)) It simplifies the macro itself and makes it explicit that the __must_be_array stuff isn't useful for the actual value. ? > > - size_mul(count, sizeof(*(p)->member) + > > __must_be_array((p)->member))) > > + size_add(size_mul(count, sizeof(*(p)->member)), \ > > + __must_be_array((p)->member))) > > -- > Kees Cook
