...

The following sections examine specific operations that are susceptible to integer overflow. The specific tests that are required to guarantee that the operation does not result in an integer overflow depend on the signedness of the integer types. When operating on small types (smaller than int), integer conversion rules apply. The usual arithmetic conversions may also be applied to (implicitly) convert operands to equivalent types before arithmetic operations are performed. Make sure you understand implicit conversion rules before trying to implement secure arithmetic operations (see INT02-A. Understand integer conversion rules).

Addition

Addition is between two operands of arithmetic type or between a pointer to an object type and an integer type. Incrementing is equivalent to adding one.

...

This solution is more readable but contains branches and consequently may be less efficient than the solution that is specific to two's complement representation.

Subtraction

Subtraction is between two operands of arithmetic type, two pointers to qualified or unqualified versions of compatible object types, or between a pointer to an object type and an integer type. Decrementing is equivalent to subtracting one.

...

pen->num_vertices = _cairo_pen_vertices_needed(gstate->tolerance, radius, &gstate->ctm);

if (pen->num_vertices > SIZE_MAX/sizeof(cairo_pen_vertex_t)) {
   /* handle error condition */
}
pen->vertices = malloc(pen->num_vertices * sizeof(cairo_pen_vertex_t));

...

Division

Division is between two operands of arithmetic type. Overflow can occur during twos-complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to -1. Both signed and unsigned division operations are also susceptible to divide-by-zero errors (see INT33-C. Ensure that division and modulo operations do not result in divide-by-zero errors).

Non-Compliant Code Example (Signed)

This code can result in a signed integer overflow during the division of the signed operands sl1 and sl2 or in a divide-by-zero error. The IA-32 architecture, for example, requires that both conditions result in a fault, which could easily result in a denial-of-service attack.

signed long sl1, sl2, result;

result = sl1 / sl2;

Compliant Solution (Signed)

This compliant solution guarantees there is no possibility of signed overflow or divide-by-zero errors.

signed long sl1, sl2, result;

if ( (sl2 == 0) || ( (sl1 == LONG_MIN) && (sl2 == -1) ) ) {
  /* handle error condition */
}
result = sl1 / sl2;

Modulo

The modulo operator provides the remainder when two operands of integer type are divided.

Non-Compliant Code Example (Signed)

This code can result in a divide-by-zero or an overflow error during the modulo operation on the signed operands sl1 and sl2. Overflow can occur during a modulo operation when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to -1.

signed long sl1, sl2, result;

result = sl1 % sl2;

Compliant Solution (Signed)

This compliant solution tests the suspect modulo operation to guarantee there is no possibility of a divide-by-zero error or an overflow error.

signed long sl1, sl2, result;

if ( (sl2 == 0 ) || ( (sl1 == LONG_MIN) && (sl2 == -1) ) ) {
  /* handle error condition */
}
result = sl1 % sl2;

...

...