Page History

...

Although unsigned left shift << can result in wrapping, modulo behavior is permitted by this standard because of common usage, because this behavior is usually expected by the programmer, and because the behavior is well-defined.

...

This compliant solution performs a precondition test of the operands of the addition to guarantee there is no possibility of unsigned wrap.:

unsigned int ui1, ui2, usum;

/* Initialize ui1 and ui2 */

if (UINT_MAX - ui1 < ui2) {
  /* handle error condition */
}
else {
  usum = ui1 + ui2;
}

...

This compliant solution performs a postcondition test to ensure that the result of the unsigned addition operation usum is not less than the first operand.:

unsigned int ui1, ui2, usum;

/* Initialize ui1 and ui2 */

usum = ui1 + ui2;
if (usum < ui1) {
  /* handle error condition */
}

...

This compliant solution performs a precondition test of the unsigned operands of the subtraction operation to guarantee there is no possibility of unsigned wrap.:

unsigned int ui1, ui2, udiff;

/* Initialize ui1 and ui2 */

if (ui1 < ui2){
   /* handle error condition */
}
else {
  udiff = ui1 - ui2;
}

...

This compliant solution performs a postcondition test that the result of the unsigned subtraction operation udiff is not greater than the minuend.:

unsigned int ui1, ui2, udiff ;

/* Initialize ui1 and ui2 */

udiff = ui1 - ui2;
if (udiff > ui1) {
  /* handle error condition */
}

...

This compliant solution tests the operands of the multiplication to guarantee that there is no unsigned integer wrap.:

pen->num_vertices = _cairo_pen_vertices_needed(
  gstate->tolerance, radius, &gstate->ctm
);

if (pen->num_vertices > SIZE_MAX/sizeof(cairo_pen_vertex_t)) {
  /* handle error condition */
}
pen->vertices = malloc(
  pen->num_vertices * sizeof(cairo_pen_vertex_t)
);

...

This noncompliant code example using atomic integers can result in unsigned integer overflow wrapping.:

atomic_int i;
int ui1;

/* Initialize i, ui1 */

atomic_fetch_add(&i, ui1);

This compliant solution performs a postcondition test to ensure that the result of the unsigned addition operation to i is not less than the operand ui1.:

atomic_int i;
int ui1;
 
/* Initialize ui1, i */
 
atomic_fetch_add(&i, ui1);
if (atomic_load(&i) < ui1) {
  /* handle error condition */
}

...

Related Vulnerabilities

CVE-2009-1385 results from a violation of this rule. The value performs an unchecked subtraction on the length of a buffer and then adds that many bytes of data to another buffer [xorl 2009]. This can cause a buffer overflow, which allows an attacker to execute arbitrary code.

...