Page History

...

This noncompliant code example may result in an unsigned integer wrap during the addition of the unsigned operands ui_a and ui_b. If this behavior is unexpected, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner that can lead to an exploitable vulnerability.

unsigned int ui_a;
unsigned int ui_b;
unsigned int usum;

void func(void) {
  /* Initialize ui_a and ui_b */
  usum = ui_a + ui_b;

  /* ... */
}

...

• Operations on two compile-time constants
• Operations on a variable and 0 (except division by 0, of course)
• Subtracting any variable from its type's maximum; for instance, any unsigned int may safely be subtracted from UINT_MAX
• Multiplying any variable by 1
• Division, as long as the divisor is nonzero
• Right-shifting any type maximum by any number smaller than the type size; for instance, UINT_MAX >> x is valid as long as 0 <=  x < 32 (assuming that the size of unsigned int is 32 bits)
• Left-shifting 1 by any number smaller than the type size

...

Automated Detection

...