[tor-bugs] #17682 [Tor]: safe_timer_diff is unsafe under wrapping

[Tor Bug Tracker & Wiki]

#17682: safe_timer_diff is unsafe under wrapping
------------------------------+------------------------------------
 Reporter:  teor              |          Owner:
     Type:  defect            |         Status:  new
 Priority:  Medium            |      Milestone:  Tor: 0.2.8.x-final
Component:  Tor               |        Version:  Tor: unspecified
 Severity:  Normal            |     Resolution:
 Keywords:  regression, easy  |  Actual Points:
Parent ID:                    |         Points:  small
  Sponsor:                    |
------------------------------+------------------------------------

Comment (by teor):

 It would be great to implement and test this once, and then use it here,
 and when we parse integers from strings, and perhaps in other locations
 that (attempt) to detect integer overflow.

 I can imagine us wanting the following behaviours:
 * saturate (clip to MIN/MAX) on over/underflow
 * fail on over/underflow
 * wrap on over/underflow (that is, a simple cast to a wide unsigned type)

 The `checked_add_1()` function in http://blog.regehr.org/archives/1139
 compiles efficiently on both clang and gcc, let's start with that as a
 base. (If we need to, we could implement it as a macro which expands into
 type-specific or outcome-specific functions.)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17682#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online