Integer operations must result in an integer value within the range of the integer type (that is, the resulting value is the same as the result produced by unlimited-range integers). Frequently, the range is more restrictive depending on the use of the integer value, for example, as an index. Integer values can be verified by code review or by static analysis.
Integer overflow is undefined behavior, so a compiled program can do anything, including go off to play the Game of Life. Furthermore, a compiler may perform optimizations that assume an overflow will never occur, which can easily yield unexpected results. Compilers can optimize away
if statements that check whether an overflow occurred. See MSC15-C. Do not depend on undefined behavior for an example.
Verifiably in-range operations are often preferable to treating out-of-range values as an error condition because the handling of these errors has been repeatedly shown to cause denial-of-service problems in actual applications. The quintessential example is the failure of the Ariane 5 launcher, which occurred because of an improperly handled conversion error that resulted in the processor being shut down [Lions 1996].
A program that detects an integer overflow to be imminent may do one of two things: (1) signal some sort of error condition or (2) produce an integer result that is within the range of representable integers on that system. Some situations can be handled by an error condition, where an overflow causes a change in control flow (such as the system complaining about bad input and requesting alternative input from the user). Others are better handled by the latter option because it allows the computation to proceed and generate an integer result, thereby avoiding a denial-of-service attack. However, when continuing to produce an integer result in the face of overflow, the question of what integer result to return to the user must be considered.
The saturation and modwrap algorithms and the technique of restricted range usage, defined in the following subsections, produce integer results that are always within a defined range. This range is between the integer values
MAX (inclusive), where
MAX are two representable integers with
MIN < MAX.
For saturation semantics, assume that the mathematical result of the computation is
result. The value actually returned to the user is set out in the following table:
Range of Mathematical Result
In modwrap semantics (also called modulo arithmetic), integer values "wrap round." That is, adding 1 to
MIN. This is the defined behavior for unsigned integers in the C Standard, subclause 6.2.5, paragraph 9. It is frequently the behavior of signed integers, as well. However, it is more sensible in many applications to use saturation semantics instead of modwrap semantics. For example, in the computation of a size (using unsigned integers), it is often better for the size to stay at the maximum value in the event of overflow rather than to suddenly become a very small value.
Restricted Range Usage
Another technique for avoiding integer overflow is to use only half the range of signed integers. For example, when using an
int, use only the range [
INT_MAX/2]. This practice has been a trick of the trade in Fortran for some time, and now that optimizing C compilers are more sophisticated, it can be valuable in C.
Consider subtraction. If the user types the expression
a - b, where both
b are in the range
[INT_MIN/2, INT_MAX/2], the result will be in the range
(INT_MIN, INT_MAX] for a typical two's complement machine.
Now, if the user types
a < b, an implicit subtraction often occurs. On a machine without condition codes, the compiler may simply issue a subtract instruction and check whether the result is negative. This behavior is allowed because the compiler is allowed to assume there is no overflow. If all explicitly user-generated values are kept in the range
[INT_MIN/2, INT_MAX/2], then comparisons will always work even if the compiler performs this optimization on such hardware.
Noncompliant Code Example
In this noncompliant example,
i + 1 will overflow on a 16-bit machine. The C Standard allows signed integers to overflow and produce incorrect results. Compilers can take advantage of this to produce faster code by assuming an overflow will not occur. As a result, the
if statement that is intended to catch an overflow might be optimized away.
long instead of an
int is guaranteed to accommodate the computed value:
Out-of-range integer values can result in reading from or writing to arbitrary memory locations and the execution of arbitrary code.
|Axivion Bauhaus Suite|
Addition Overflow of Allocation Size
Integer Overflow of Allocation Size
Multiplication Overflow of Allocation Size
Subtraction Underflow of Allocation Size
Addition Overflow of Size
Unreasonable Size Argument
Multiplication Overflow of Size
Subtraction Underflow of Size
Could detect violations of this recommendation by flagging any comparison expression involving addition that could potentially overflow. For example, instead of comparing
DF2801, DF2802, DF2803, DF2911, DF2912, DF2913
|LDRA tool suite|
488 S, 493 S, 493 S
Avoid data loss when converting between integer types
648, 650, 679, 680, 776,
|Polyspace Bug Finder|
|CERT C: Rec. INT08-C||Checks for integer overflow or integer constant overflow (rec. fully covered)|
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
|SEI CERT C++ Coding Standard||VOID INT08-CPP. Verify that all integer values are in range|
|ISO/IEC TR 24772:2013||Numeric Conversion Errors [FLC]|