safe_math.h#

namespace onnx_light

Alias that makes onnx-light headers compatible with code that references ONNX_LIGHT_NAMESPACE (the macro used in the standard onnx package).

Set to ONNX_LIGHT_NAMESPACE so both names resolve to the same namespace.

Symbol-visibility attribute for the public onnx-light C++ API.

Maps the upstream compatibility macro to onnx-light’s explicit proto ABI annotation. This keeps declarations from vendored ONNX headers visible when lib_onnx_proto uses hidden visibility by default.

Namespace alias so that ONNX C++ code (and consumers such as onnxruntime) that refers to the literal onnx namespace — rather than the ONNX_NAMESPACE macro — resolves to the onnx-light namespace. The standard onnx package lives in namespace onnx; onnx-light uses onnx_light (via ONNX_LIGHT_NAMESPACE), so this alias keeps onnx-light a true drop-in. It is only introduced when the onnx-light namespace differs from onnx.

Functions

inline bool checked_mul_overflow(int64_t a, int64_t b, int64_t *result)#

Multiplies two signed int64 values, reporting overflow.

Uses __builtin_mul_overflow on GCC/Clang. The MSVC fallback compares against the int64 bounds per sign combination (the classic CERT INT32-C style check, generalized to 64 bits) before multiplying, so it never computes a product that doesn’t fit and never divides INT64_MIN by -1.

Parameters:

  • a – First operand.

  • b – Second operand.

  • result – Receives the product when no overflow occurs.

Returns:

True on overflow, false otherwise.

inline bool checked_add_overflow(int64_t a, int64_t b, int64_t *result)#

Adds two signed int64 values, reporting overflow.

Uses __builtin_add_overflow on GCC/Clang. The MSVC fallback uses unsigned addition (no UB) and detects overflow via a sign-bit XOR. The cast back to int64_t is implementation-defined in C++17 but gives two’s-complement on every MSVC target; it is mandated by the standard from C++20. Overflow occurs iff a and b have the same sign but the result has the opposite sign.

Parameters:

  • a – First operand.

  • b – Second operand.

  • result – Receives the sum when no overflow occurs.

Returns:

True on overflow, false otherwise.

inline bool checked_sub_overflow(int64_t a, int64_t b, int64_t *result)#

Subtracts two signed int64 values, reporting overflow.

Uses __builtin_sub_overflow on GCC/Clang. The MSVC fallback uses unsigned subtraction (no UB) and detects overflow via a sign-bit XOR. Overflow occurs iff a and b have different signs and the result has a different sign from a.

Parameters:

  • a – First operand.

  • b – Second operand.

  • result – Receives the difference when no overflow occurs.

Returns:

True on overflow, false otherwise.

template<typename Iter, typename ErrorHandler>
inline int64_t safe_dim_product(Iter begin, Iter end, ErrorHandler on_error)#

Computes the product of dims over an iterator range with overflow checks.

Calls on_error with a const char* message on a negative dim or on overflow. on_error must not return (i.e. must throw or abort).

Parameters:

  • begin – Iterator to the first dimension.

  • end – Iterator past the last dimension.

  • on_error – Handler invoked on a negative dimension or overflow.

Returns:

The product of the dimensions in the range.

template<typename DimsContainer, typename ErrorHandler>
inline int64_t safe_dim_product(const DimsContainer &dims, ErrorHandler on_error)#

Computes the product of dims in a container with overflow checks.

Delegates to the iterator-pair overload of safe_dim_product().

Parameters:

  • dims – Container of dimensions.

  • on_error – Handler invoked on a negative dimension or overflow.

Returns:

The product of the dimensions in the container.

template<typename ErrorHandler>
inline size_t safe_cast_to_size(int64_t value, ErrorHandler on_error)#

Casts an int64_t to size_t, reporting values out of range.

Calls on_error if the value exceeds the size_t range (relevant for 32-bit platforms where size_t is 32 bits). value must be non-negative (callers ensure this via prior overflow checks).

Parameters:

  • value – Non-negative value to cast.

  • on_error – Handler invoked when value is too large for size_t.

Returns:

The value cast to size_t.