Page History

...

This noncompliant code example may result in an unsigned integer wrap during the addition of the unsigned operands ui1 and ui2. If this behavior is unexpected, the resulting value may be used to allocate insufficient memory for a subsequent operation or in some other manner that can lead to an exploitable vulnerability.

unsigned int ui1, ui2, usum;

/* Initialize ui1 and ui2 */

usum = ui1 + ui2;

...

This compliant solution performs a pre-condition test of the operands of the addition to guarantee there is no possibility of unsigned wrap.

unsigned int ui1, ui2, usum;

/* Initialize ui1 and ui2 */

if (UINT_MAX - ui1 < ui2) {
  /* handle error condition */
}
else {
  usum = ui1 + ui2;
}

...

This compliant solution performs a post-condition test to ensure that the result of the unsigned addition operation usum is not less than the first operand.

unsigned int ui1, ui2, usum;

/* Initialize ui1 and ui2 */

usum = ui1 + ui2;
if (usum < ui1) {
  /* handle error condition */
}

...

This noncompliant code example may result in an unsigned integer wrap during the subtraction of the unsigned operands ui1 and ui2. If this behavior is unanticipated, it may lead to an exploitable vulnerability.

unsigned int ui1, ui2, udiff;

/* Initialize ui1 and ui2 */

udiff = ui1 - ui2;

...

This compliant solution performs a pre-condition test of the unsigned operands of the subtraction operation to guarantee there is no possibility of unsigned wrap.

unsigned int ui1, ui2, udiff;

/* Initialize ui1 and ui2 */

if (ui1 < ui2){
   /* handle error condition */
}
else {
  udiff = ui1 - ui2;
}

...

This compliant solution performs a post-condition test that the result of the unsigned subtraction operation udiff is not greater than the minuend.

unsigned int ui1, ui2, udiff ;

/* Initialize ui1 and ui2 */

udiff = ui1 - ui2;
if (udiff > ui1) {
  /* handle error condition */
}

...

The Mozilla Scalable Vector Graphics (SVG) viewer contains a heap buffer overflow vulnerability resulting from an unsigned integer wrap during the multiplication of the {{signed int}} value {{pen->num_vertices}} and the {{size_t}} value {{sizeof(cairo_pen_vertex_t)}} \[[VU#551436|AA. Bibliography#VU551436]\].  The {{signed int}} operand is converted to {{size_t}} prior to the multiplication operation so that the multiplication takes place between two {{size_t}} integers, which are unsigned. (See recommendation [INT02-C. Understand integer conversion rules|INT02-C. Understand integer conversion rules].)

pen->num_vertices = _cairo_pen_vertices_needed(
  gstate->tolerance, radius, &gstate->ctm
);
pen->vertices = malloc(
  pen->num_vertices * sizeof(cairo_pen_vertex_t)
);

...

This compliant solution tests the operands of the multiplication to guarantee that there is no unsigned integer wrap.

pen->num_vertices = _cairo_pen_vertices_needed(
  gstate->tolerance, radius, &gstate->ctm
);

if (pen->num_vertices > SIZE_MAX/sizeof(cairo_pen_vertex_t)) {
  /* handle error condition */
}
pen->vertices = malloc(
  pen->num_vertices * sizeof(cairo_pen_vertex_t)
);

...