Page History

The C Standard, 6.2.5, paragraph 9 11 [ISO/IEC 9899:20112024], states:

A computation involving unsigned operands can never produce an overflow, because a result that cannot be represented by the resulting unsigned integer type is reduced modulo the number that is one greater than the largest value that can be represented by the resulting typearithmetic for the unsigned type is performed modulo 2^N .

This behavior is more informally called unsigned integer wrapping. Unsigned integer operations can wrap if the resulting value cannot be represented by the underlying representation of the integer. The following table indicates which operators can result in wrapping:

The following sections examine specific operations that are susceptible to unsigned integer wrap. When operating on integer types with less precision than int, integer promotions are applied. The usual arithmetic conversions may also be applied to (implicitly) convert operands to equivalent types before arithmetic operations are performed. Programmers should understand integer conversion rules before trying to implement secure arithmetic operations. (see See INT02-C. Understand integer conversion rules.).

Integer values must not be allowed to wrap, especially if they are used in any of the following ways:

...

Addition is between two operands of arithmetic type or between a pointer to an object type and an integer type. This rule only applies to only to addition between two operands of arithmetic type. (see See ARR37-C. Do not add or subtract an integer to a pointer to a non-array object and ARR30-C. Do not form or use out-of-bounds pointers or array subscripts.).

Incrementing is equivalent to adding 1.

...

Subtraction is between two operands of arithmetic type, two pointers to qualified or unqualified versions of compatible object types, or a pointer to an object type and an integer type. This rule only applies to only to subtraction between two operands of arithmetic type. (see See ARR36-C. Do not subtract or compare two pointers that do not refer to the same array, ARR37-C. Do not add or subtract an integer to a pointer to a non-array object, and ARR30-C. Do not form or use out-of-bounds pointers or array subscripts for information about pointer subtraction.).

Decrementing is equivalent to subtracting 1.

...

The Mozilla Foundation Security Advisory 2007-01 describes a heap buffer overflow vulnerability in the Mozilla Scalable Vector Graphics (SVG) viewer resulting from an unsigned integer wrap during the multiplication of the signed int value pen->num_vertices and the size_t value sizeof(cairo_pen_vertex_t) [VU#551436]. The signed int operand is converted to size_t prior to the multiplication operation so that the multiplication takes place between two size_t integers, which are unsigned. (see See INT02-C. Understand integer conversion rules.).

pen->num_vertices = _cairo_pen_vertices_needed(
  gstate->tolerance, radius, &gstate->ctm
);
pen->vertices = malloc(
  pen->num_vertices * sizeof(cairo_pen_vertex_t)
);

...

Integer wrap can lead to buffer overflows and the execution of arbitrary code by an attacker.

Automated Detection

Related Vulnerabilities

CVE-2009-1385 results from a violation of this rule. The value performs an unchecked subtraction on the length of a buffer and then adds that many bytes of data to another buffer [xorl 2009]. This can cause a buffer overflow, which allows an attacker to execute arbitrary code.

A Linux kernel vmsplice exploit, described by Rafal Wojtczuk [Wojtczuk 2008], documents a vulnerability and exploit arising from a buffer overflow (caused by unsigned integer wrapping).

Don Bailey [Bailey 2014] describes an unsigned integer wrap vulnerability in the LZO compression algorithm, which can be exploited in some implementations.

CVE-2014-4377 describes a vulnerability in iOS 7.1 resulting from a multiplication operation that wraps, producing an insufficiently small value to pass to a memory allocation routine, which is subsequently overflowed.

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...

INT02-C. Understand integer conversion rules
ARR30-C. Do not form or use out-of-bounds pointers or array subscripts
ARR36-C. Do not subtract or compare two pointers that do not refer to the same array
ARR37-C. Do not add or subtract an integer to a pointer to a non-array object
CON08-C. Do not assume that a group of calls to independently atomic methods is atomic

...

Related Vulnerabilities

CVE-2009-1385 results from a violation of this rule. The value performs an unchecked subtraction on the length of a buffer and then adds those many bytes of data to another buffer [xorl 2009]. This can cause a buffer overflow, which allows an attacker to execute arbitrary code.

A Linux Kernel vmsplice exploit, described by Rafal Wojtczuk [Wojtczuk 2008], documents a vulnerability and exploit arising from a buffer overflow (caused by unsigned integer wrapping).

Don Bailey [Bailey 2014] describes an unsigned integer wrap vulnerability in the LZO compression algorithm, which can be exploited in some implementations.

CVE-2014-4377 describes a vulnerability in iOS 7.1 resulting from a multiplication operation that wraps, producing an insufficiently small value to pass to a memory allocation routine, which is subsequently overflowed.

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-131 and INT30-C

• Intersection( INT30-C, MEM35-C) = Ø

• Intersection( CWE-131, INT30-C) =

• Calculating a buffer size such that the calculation wraps. This can happen, for example, when using malloc() or operator new[] to allocate an array, multiplying the array item size with the array dimension. An untrusted dimension could cause wrapping, resulting in a too-small buffer being allocated, and subsequently overflowed when the array is initialized.

• CWE-131 – INT30-C =

• Incorrect calculation of a buffer size that does not involve wrapping. This includes off-by-one errors, for example.

INT30-C – CWE-131 =

• Integer wrapping where the result is not used to allocate memory.

CWE-680 and INT30-C

Intersection( CWE-680, INT30-C) =

• Unsigned integer overflows that lead to buffer overflows

CWE-680 - INT30-C =

• Signed integer overflows that lead to buffer overflows

INT30-C – CWE-680 =

• Unsigned integer overflows that do not lead to buffer overflows

CWE-191 and INT30-C

Union( CWE-190, CWE-191) = Union( INT30-C, INT32-C) Intersection( INT30-C, INT32-C) == Ø

Intersection(CWE-191, INT30-C) =

• Underflow of unsigned integer operation

CWE-191 – INT30-C =

• Underflow of signed integer operation

INT30-C – CWE-191 =

• Overflow of unsigned integer operation

...

Bibliography

...

...

Image Modified Image Modified Image Modified