...
Integer overflow is undefined behavior, so a compiled program can do anything, including going off to play the Game of Life. Furthermore, a compiler may perform optimizations that assume an overflow will never occur, which can easily yield unexpected results. Compilers can optimize away if statements that check if whether an overflow occuredoccurred. See MSC15-C. Do not depend on undefined behavior for an example.
| Wiki Markup |
|---|
Verifiably in-range operations are often preferable to treating out-of-range values as an error condition because the handling of these errors has been repeatedly shown to cause denial-of-service problems in actual applications. The quintessential example of this is the failure of the Ariane 5 launcher, which occurred duebecause toof an improperly handled conversion error that resulted in the processor being shut down \[[Lions 96|AA. C References#Lions 96]\]. |
A program that detects an integer overflow to be imminent may do one of two things: (1) signal some sort of error condition , or (2) produce an integer result that is within the range of representable integers on that system. Some situations can be handled by an error condition, where an overflow causes a change in control flow (such as the system complaining about bad input and requesting alternate alternative input from the user). Others are better handled by the latter option , in that because it allows the computation to proceed and generate an integer result, as a result thereby avoiding a denial-of-service attack. However, when continuing to produce an integer result in the face of overflow, one must consider the question of what integer result to return to the user must be considered.
The saturation and modwrap algorithms , and the technique of restricted range usage, defined in the following subsections, produce integer results that are always within a defined range. This range is between the integer values MIN and MAX (inclusive), where MIN and MAX are two representable integers with MIN < MAX.
...
Noncompliant Code Example
In the following this noncompliant example, i + 1 will overflow on a 16-bit machine. The C standard allows signed integers to overflow and produce incorrect results. Compilers can take advantage of this to produce faster code by assuming an overflow will not occur. As a result, the if statement that is intended to catch an overflow might be optimized away.
...