Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3aa0615a5649159574e60d2f003887557a9108eb
https://github.com/WebKit/WebKit/commit/3aa0615a5649159574e60d2f003887557a9108eb
Author: Ahmad Saleem <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
M Source/WTF/wtf/MathExtras.h
M Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp
Log Message:
-----------
WTF::divideRoundedUp can overflow for dividends near the type's maximum
https://bugs.webkit.org/show_bug.cgi?id=319520
rdar://182336325
Reviewed by Chris Dumez.
divideRoundedUp(a, b) computed (a + b - 1) / b, whose intermediate
a + b - 1 overflows when a is close to the maximum representable value
of T. All callers use size_t, so this wraps silently: for example
divideRoundedUp<uint8_t>(255, 2) computes 255 + 2 - 1 = 256, which
wraps to 0, yielding 0 instead of the correct 128.
Rewrite it in the overflow-safe form a / b + !!(a % b), which is
mathematically equivalent for non-negative operands (the ceil-division
domain) and cannot overflow: a / b <= a, and the +1 is never added when
a / b is already at the maximum (b == 1 implies a % b == 0).
Test: Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp
* Source/WTF/wtf/MathExtras.h:
(divideRoundedUp):
* Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp:
(TestWebKitAPI::TEST(WTF, divideRoundedUp)):
Canonical link: https://commits.webkit.org/317292@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
