§ Coverage
1/*2 * sc_sat.c -- implementation. Blocks are tagged with the low-level3 * requirement they satisfy; see requirements/sc_sat.md.4 *5 * Both checks rearrange the overflow test so no intermediate can itself6 * overflow: for `a + b`, INT32_MAX - b is safe when b > 0 and INT32_MIN - b7 * is safe when b < 0 (and symmetrically for subtraction).8 */9#include "sc_sat.h"10112207int32_t sc_sat_add_i32(int32_t a, int32_t b)12{13 int32_t result;14152207 if ((b > 0) && (a > (INT32_MAX - b)))condition outcomes covered 4/416 {174 result = INT32_MAX; /* LLR-SAT-1 */18 }192203 else if ((b < 0) && (a < (INT32_MIN - b)))condition outcomes covered 4/420 {212 result = INT32_MIN; /* LLR-SAT-2 */22 }23 else24 {252201 result = a + b; /* LLR-SAT-3 */26 }27282207 return result;29}30312197int32_t sc_sat_sub_i32(int32_t a, int32_t b)32{33 int32_t result;34352197 if ((b < 0) && (a > (INT32_MAX + b)))condition outcomes covered 4/436 {374 result = INT32_MAX; /* LLR-SAT-4 */38 }392193 else if ((b > 0) && (a < (INT32_MIN + b)))condition outcomes covered 4/440 {414 result = INT32_MIN; /* LLR-SAT-5 */42 }43 else44 {452189 result = a - b; /* LLR-SAT-6 */46 }47482197 return result;49}