...
This behavior is more informally called unsigned integer wrapping. Unsigned integer operations can wrap if the resulting value cannot be represented by the underlying representation of the integer. The following table indicates which operators can result in wrapping:
Operator | Wrap | Operator | Wrap | Operator | Wrap | Operator | Wrap |
|---|---|---|---|---|---|---|---|
Yes | Yes | Yes |
| No | |||
Yes | Yes |
| No |
| No | ||
Yes |
| No |
| No |
| No | |
| No |
| No |
| No |
| No |
| No | Yes |
| No |
| No | |
| Yes |
| No |
| No |
| No |
| Yes |
| No |
| No |
| No |
| No |
| No |
| No |
| No |
Yes |
| No |
| Yes |
| No |
The following sections examine specific operations that are susceptible to unsigned integer wrap. When operating on integer types with less precision than int, integer promotions are applied. The usual arithmetic conversions may also be applied to (implicitly) convert operands to equivalent types before arithmetic operations are performed. Programmers should understand integer conversion rules before trying to implement secure arithmetic operations. (See INT02-C. Understand integer conversion rules.)
...
Integer wrap can lead to buffer overflows and the execution of arbitrary code by an attacker.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
INT30-C | High | Likely | High | P9 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| integer-overflow | Fully checked | ||||||
| CodeSonar |
| ALLOC.SIZE.ADDOFLOW | Addition overflow of allocation size | ||||||
| Compass/ROSE |
Can detect violations of this rule by ensuring that operations are checked for overflow before being performed (Be mindful of exception INT30-EX2 because it excuses many operations from requiring validation, including all the operations that would validate a potentially dangerous operation. For instance, adding two | |||||||||
| Coverity |
| INTEGER_OVERFLOW | Implemented | ||||||
| Klocwork |
| NUM.OVERFLOW CWARN.NOEFFECT.OUTOFRANGE |
| LDRA tool suite |
| 493 S, 494 S | Partially implemented | ||||||
| Parasoft C/C++test |
| BD-PB-INTOVERF, PB-66_a, PB-66_b | Implemented | ||||||
| Polyspace Bug Finder | R2016a | Unsigned integer overflow | Overflow from operation between unsigned integers | ||||||
| PRQA QA-C |
| 2910 (C) | Partially implemented | ||||||
| PRQA QA-C++ |
| 2910, 2911, 2912, 2913 |
| RuleChecker |
| integer-overflow | Fully checked |
Related Vulnerabilities
CVE-2009-1385 results from a violation of this rule. The value performs an unchecked subtraction on the length of a buffer and then adds those many bytes of data to another buffer [xorl 2009]. This can cause a buffer overflow, which allows an attacker to execute arbitrary code.
...
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C | INT02-C. Understand integer conversion rules | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C | ARR30-C. Do not form or use out-of-bounds pointers or array subscripts | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C | ARR36-C. Do not subtract or compare two pointers that do not refer to the same array | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C | ARR37-C. Do not add or subtract an integer to a pointer to a non-array object | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C | CON08-C. Do not assume that a group of calls to independently atomic methods is atomic | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TR 24772:2013 | Arithmetic Wrap-Around Error [FIF] | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CWE 2.11 | CWE-190, Integer Overflow or Wraparound | 2016-12-02: CERT: Rule subset of CWE |
| CWE 2.11 | CWE-131 | 2017-05-16: CERT: Partial overlap |
| CWE 2.11 | CWE-191 | 2017-05-18: CERT: Partial overlap |
| CWE 2.11 | CWE-680 | 2017-05-18: CERT: Partial overlap |
CERT-CWE Mapping Notes
Key here for mapping notes
...
- Overflow of unsigned integer operation
Bibliography
| [Bailey 2014] | Raising Lazarus - The 20 Year Old Bug that Went to Mars |
| [Dowd 2006] | Chapter 6, "C Language Issues" ("Arithmetic Boundary Conditions," pp. 211–223) |
| [ISO/IEC 9899:2011] | Subclause 6.2.5, "Types" |
| [Seacord 2013b] | Chapter 5, "Integer Security" |
| [Viega 2005] | Section 5.2.7, "Integer Overflow" |
| [VU#551436] |
| [Warren 2002] | Chapter 2, "Basics" |
| [Wojtczuk 2008] |
| [xorl 2009] | "CVE-2009-1385: Linux Kernel E1000 Integer Underflow" |
...
...