Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Integer overflow is undefined behavior, so a compiled program can do anything, including going off to play the Game of Life. Furthermore, a compiler may perform optimizations that assume an overflow will never occur, which can easily yield unexpected results. Compilers can optimize away if statements that check whether an overflow occurred. See guideline recommendation MSC15-C. Do not depend on undefined behavior for an example.

...

Wiki Markup
In modwrap semantics (also called _modulo_ arithmetic), integer values "wrap round."  That is, adding one to {{MAX}} produces {{MIN}}.  This is the defined behavior for unsigned integers in the C Standard \[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\], Section 6.2.5, "Types," paragraph 9,. andThis is frequently the behavior of signed integers, as well.  However, it is more sensible in many applications to use saturation semantics instead of modwrap semantics.  For example, in the computation of a size (using unsigned integers), it is often better for the size to stay at the maximum value in the event of overflow rather than suddenly becoming a very small value.

...

Wiki Markup
Now, if the user types {{a < b}}, there is often an implicit subtraction happening.  On a machine without condition codes, the compiler may simply issue a subtract instruction and check whether the result is negative.  This is allowed because the compiler is allowed to assume there is no overflow.  If all explicitly user-generated values are kept in the range {{\[INT_MIN/2, INT_MAX/2\]}}, then comparisons will always work even if the compiler performs this optimization on such hardware.

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: INT08-CPP. Verify that all integer values are in range

Bibliography

unmigrated-wiki-markup

\[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] TR 24772 "FLC Numeric Conversion Errors"

Bibliography

Wiki Markup

\[[Lions 1996|AA. Bibliography#Lions 96]\]

...