...

Division in C is between two operands of arithmetic type. Overflow can occur during twos-complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to -1. Both signed and unsigned division operations are also susceptible to divide-by-zero errors.

Non-compliant Code Example

...

The following compliant solution tests the suspect division operation to guarantee there is no possibility of signed overflow or divide-by-zero errors.

signed long sl1, sl2, result;

if ( (sl2 == 0) || ( (sl1 == LONG_MIN) && (sl2 == -1) ) ) {
  /* handle error condition */
}
result = sl1 / sl2;

Modulo

Modulo in C is between two operands of integer type.

Non-compliant Code Example

The following code can result in a signed integer overflow during the modulo operation on the signed operands sl1 and sl2. If this behavior is unanticipated, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner which could lead to an exploitable vulnerability.

signed long sl1, sl2, result;

result = sl1 % sl2;

Compliant Solution

The following compliant solution tests the suspect modulo operation to guarantee there is no possibility of signed overflow.

signed long sl1, sl2, result;

if (sl2 == 0) {
  /* handle error condition */
}
result = sl1 % sl2;

Unary Negation

The unary negation operator in C takes an operand of arithmetic type. Overflow can occur during twos-complement unary negation when the operand is equal to the minimum (negative) value for the signed integer type.

Non-compliant Code Example

The following code can result in a signed integer overflow during the unary negation of the signed operand si1. If this behavior is unanticipated, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner which could lead to an exploitable vulnerability.

signed int si1, result;

result = -si1;

Compliant Solution

The following compliant solution tests the suspect negation operation to guarantee there is no possibility of signed overflow.

...

The shift operator in C is between two operands of integer type.

Non-compliant Code Example

The following code can result in an unsigned overflow during the shift operation of the unsigned operands ui1 and ui2. If this behavior is unanticipated, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner which could lead to an exploitable vulnerability.

unsigned int ui1, ui2, result;

result = ui1 << ui2;

Compliant Solution

The following compliant solution tests the suspect shift operation to guarantee there is no possibility of unsigned overflow.

...

The shift operator in C is between two operands of integer type.

Non-compliant Code Example

The following code can result in an unsigned overflow during the shift operation of the unsigned operands ui1 and ui2. If this behavior is unanticipated, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner which could lead to an exploitable vulnerability.

unsigned int ui1, ui2, result;

result = ui1 >> ui2;

Compliant Solution

The following compliant solution tests the suspect shift operation to guarantee there is no possibility of unsigned overflow.

...