Page History

...

#include <limits.h>
 
void f(signed int si_a, signed int si_b) {
  signed int sum;
  if (((si_b > 0) && (si_a > (INT_MAX - si_b))) ||
      ((si_b < 0) && (si_a < (INT_MIN - si_b)))) {
    /* Handle error */
  } else {
    sum = si_a + si_b;
  }
  /* ... */
}

Compliant Solution (

...

C23, Checked Integers)

This compliant solution uses the GNU extension __builtin_sadd_overflow, available with GCC, Clang, and ICCnew-to-C23 checked integer arithmetic to safely perform integer addition:

#include <stdckdint.h>

void f(signed int si_a, signed int si_b) {
  signed int sum;
  if (__builtin_sadd_overflow(ckd_add(&sum, si_a, si_b, &sum)) {
    /* Handle error */
  }
  /* ... */
}

...

#include <limits.h>
 
void func(signed int si_a, signed int si_b) {
  signed int diff;
  if ((si_b > 0 && si_a < INT_MIN + si_b) ||
      (si_b < 0 && si_a > INT_MAX + si_b)) {
    /* Handle error */
  } else {
    diff = si_a - si_b;
  }

  /* ... */
}

Compliant Solution (

...

C23, Checked Integers)

This compliant solution uses the GNU extension __builtin_ssub_overflow, available with GCC, Clang, and ICCnew-to-C23 checked integer arithmetic to safely perform integer subtraction:

#include <stdckdint.h>

void funcf(signed int si_a, signed int si_b) {
  signed int diff;
  if (__builtin_ssub_overflow(ckd_sub(&diff, si_a, si_b, &diff)) {
    /* Handle error */
  }

  /* ... */
}

Multiplication

...

#include <limits.h>
 
void func(signed int si_a, signed int si_b) {
  signed int result;  
  if (si_a > 0) {  /* si_a is positive */
    if (si_b > 0) {  /* si_a and si_b are positive */
      if (si_a > (INT_MAX / si_b)) {
        /* Handle error */
      }
    } else { /* si_a positive, si_b nonpositive */
      if (si_b < (INT_MIN / si_a)) {
        /* Handle error */
      }
    } /* si_a positive, si_b nonpositive */
  } else { /* si_a is nonpositive */
    if (si_b > 0) { /* si_a is nonpositive, si_b is positive */
      if (si_a < (INT_MIN / si_b)) {
        /* Handle error */
      }
    } else { /* si_a and si_b are nonpositive */
      if ( (si_a != 0) && (si_b < (INT_MAX / si_a))) {
        /* Handle error */
      }
    } /* End if si_a and si_b are nonpositive */
  } /* End if si_a is nonpositive */

  result = si_a * si_b;
}

Compliant Solution (

...

C23, Checked Integers)

This compliant solution uses the GNU extension __builtin_smul_overflow, available with GCC, Clang, and ICCnew-to-C23 checked integer arithmetic to safely perform integer subtraction:

#include <stdckdint.h>

void func(signed int si_a, signed int si_b) {
  signed int resultproduct;
  if (__builtin_smul_overflow(ckd_mul(&product, si_a, si_b, &result)) {
    /* Handle error */
  }
  /* ... */
}

Division

Division is between two operands of arithmetic type. Overflow can occur during two's complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. Division operations are also susceptible to divide-by-zero errors. (See INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors.)

...

The C Standard, 6.5.8, paragraph 4 [ISO/IEC 9899:2024], states

...

In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the operand indicates a logic error. These issues are covered by INT34-C. Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand.

Noncompliant Code Example

This noncompliant code example performs a left shift, after verifying that the number being shifted is not negative, and the number of bits to shift is valid.  The PRECISION() macro and popcount() function provide the correct precision for any integer type. (See INT35-C. Use correct integer precisions.) However, because this code does no overflow check, it can result in an unrepresentable value. 

...

Compliant Solution

This compliant solution eliminates the possibility of overflow resulting from a left-shift operation:

...

Integer overflow can lead to buffer overflows and the execution of arbitrary code by an attacker.

Automated Detection

...