Signed integer overflow is undefined behavior 36. Consequently, implementations have considerable latitude in how they deal with signed integer overflow. (see See MSC15-C. Do not depend on undefined behavior.) . An implementation that defines signed integer types as being modulo, for example, need not detect integer overflow. Implementations may also trap on signed arithmetic overflows, or simply assume that overflows will never happen and generate object code accordingly. It is also possible for the same conforming implementation to emit code that exhibits different behavior in different contexts. For example, an implementation may determine that a signed integer loop control variable declared in a local scope cannot overflow and may emit efficient code on the basis of that determination, while the same implementation may determine that a global variable used in a similar context will wrap.

...

Integer operands of any pointer arithmetic, including array indexing;
The assignment expression for the declaration of a variable length array;
The postfix expression preceding square brackets [] or the expression in square brackets [] of a subscripted designation of an element of an array object; and
Function arguments of type size_t or rsize_t (for example, an argument to a memory allocation function).

Integer operations will overflow if the resulting value cannot be represented by the underlying representation of the integer. The following table indicates which operations can result in overflow.

Operator	Overflow	Operator	Overflow	Operator	Overflow	Operator	Overflow
`+`	Yes	`-=`	Yes	`<<`	Yes	`<`	No
`-`	Yes	`*=`	Yes	`>>`	No	`>`	No
`*`	Yes	`/=`	Yes	`&`	No	`>=`	No
`/`	Yes	`%=`	Yes	`\|`	No	`<=`	No
`%`	Yes	`<<=`	Yes	`^`	No	`==`	No
`++`	Yes	`>>=`	No	`~`	No	`!=`	No
`--`	Yes	`&=`	No	`!`	No	`&&`	No
`=`	No	`\|=`	No

un

`unary +`	No	`\|\|`	No
`+=`	Yes	`^=`	No

un

unary -

Yes

?:

No

The following sections examine specific operations that are susceptible to integer overflow. When operating on integer types with less precision than int, integer promotions are applied. The usual arithmetic conversions may also be applied to (implicitly) convert operands to equivalent types before arithmetic operations are performed. Programmers should understand integer conversion rules before trying to implement secure arithmetic operations. (see See INT02-C. Understand integer conversion rules.).

Implementation Details

GNU GCC invoked with the -fwrapv command-line option defines the same modulo arithmetic for both unsigned and signed integers.

...

GNU GCC invoked without either the -fwrapv or the -ftrapv option may simply assume that signed integers never overflow and may generate object code accordingly.

Atomic Integers

The C Standard defines the behavior of arithmetic on atomic signed integer types to use two's complement representation with silent wraparound on overflow; there are no undefined results. Although defined, these results may be unexpected and therefore carry similar risks to unsigned integer wrapping. (see See INT30-C. Ensure that unsigned integer operations do not wrap.) . Consequently, signed integer overflow of atomic integer types should also be prevented or detected. Anchor

Addition

Addition is between two operands of arithmetic type or between a pointer to an object type and an integer type. This rule applies only to addition between two operands of arithmetic type. (see See ARR37-C. Do not add or subtract an integer to a pointer to a non-array object and ARR30-C. Do not form or use out-of-bounds pointers or array subscripts.).

Incrementing is equivalent to adding 1.

Noncompliant Code Example

This noncompliant code example can result in a signed integer overflow during the addition of the signed operands si_a and si_b:

Code Block

bgColor	#FFcccc
lang	c

void func(signed int si_a, signed int si_b) {
  signed int sum = si_a + si_b;
  /* ... */
}

Compliant Solution

This compliant solution ensures that the addition operation cannot overflow, regardless of representation:

Code Block

bgColor	#ccccff
lang	c

#include <limits.h>
 
void f(signed int si_a, signed int si_b) {
  signed int sum;
  if (((si_b > 0) && (si_a > (INT_MAX - si_b))) ||
      ((si_b < 0) && (si_a < (INT_MIN - si_b)))) {
    /* Handle error */
  } else {
    sum = si_a + si_b;
  }
  /* ... */
}

...

Compliant Solution (GNU)

This compliant solution uses the GNU extension __builtin_sadd_overflow, available with GCC, Clang, and ICC:

Code Block

bgColor	#ccccff
lang	c

void f(signed int si_a, signed int si_b) {
  signed int sum;
  if (__builtin_sadd_overflow(si_a, si_b, &sum)) {
    /* Handle error */
  }
  /* ... */
}

Subtraction

Subtraction is between two operands of arithmetic type, two pointers to qualified or unqualified versions of compatible object types, or a pointer to an object

...

Subtraction

Subtraction is between two operands of arithmetic type, two pointers to qualified or unqualified versions of compatible object types, or a pointer to an object type and an integer type. This rule applies only to subtraction between two operands of arithmetic type. (see See ARR36-C. Do not subtract or compare two pointers that do not refer to the same array, ARR37-C. Do not add or subtract an integer to a pointer to a non-array object, and ARR30-C. Do not form or use out-of-bounds pointers or array subscripts for information about pointer subtraction.).

Decrementing is equivalent to subtracting 1.

Noncompliant Code Example

This noncompliant code example can result in a signed integer overflow during the subtraction of the signed operands si_a and si_b:

Code Block

bgColor	#FFcccc
lang	c

void func(signed int si_a, signed int si_b) {
  signed int diff = si_a - si_b;
  /* ... */
}

Compliant Solution

This compliant solution tests the operands of the subtraction to guarantee there is no possibility of signed overflow, regardless of representation:

Code Block

bgColor	#ccccff
lang	c

#include <limits.h>
 
void func(signed int si_a, signed int si_b) {
  signed int diff;
  if ((si_b > 0 && si_a < INT_MIN + si_b) ||
      (si_b < 0 && si_a > INT_MAX + si_b)) {
    /* Handle error */
  } else {
    diff = si_a - si_b;
  }

  /* ... */
}

...

Compliant Solution (GNU)

This compliant solution uses the GNU extension __builtin_ssub_overflow, available with GCC, Clang, and ICC

...

Multiplication

Multiplication is between two operands of arithmetic type.

Noncompliant Code Example

This noncompliant code example can result in a signed integer overflow during the multiplication of the signed operands si_a and si_b:

Code Block

bgColor	#FFcccc#ccccff
lang	c

void func(signed int si_a, signed int si_b) {
  signed int result = si_a * si_b;diff;
  if (__builtin_ssub_overflow(si_a, si_b, &diff)) {
    /* Handle error */
  }

  /* ... */
}

Compliant Solution

Multiplication

Multiplication is between two operands of arithmetic type.

Noncompliant Code Example

This noncompliant code example can result in a signed integer overflow during the multiplication of the signed operands si_a and si_bThe product of two operands can always be represented using twice the number of bits than exist in the precision of the larger of the two operands. This compliant solution eliminates signed overflow on systems where long long is at least twice the precision of int:

Code Block

bgColor	#ccccff#FFcccc
lang	c

#include <stddef.h>
#include <assert.h>
#include <limits.h>
#include <inttypes.h>
 
extern size_t popcount(uintmax_t);
#define PRECISION(umax_value) popcount(umax_value) 
  
void func(signed int si_a, signed int si_b) {
  signed int result;
  signed long long tmp;
  assert(PRECISION(ULLONG_MAX) >= 2 * PRECISION(UINT_MAX));
  tmp = (signed long long)si_a * (signed long long)si_b;
 
  /*
   * If the product cannot be represented as a 32-bit integer,
   * handle as an error condition.
   */
  if ((tmp > INT_MAX) || (tmp < INT_MIN)) {
    /* Handle error */
  } else {
    result = (int)tmp;
  }
  /* ... */
}

The assertion fails if long long has less than twice the precision of int. The PRECISION() macro and popcount() function provide the correct precision for any integer type (see INT35-C. Use correct integer precisions).

Compliant Solution

The following portable compliant solution can be used with any conforming implementation, including those that do not have an integer type that is at least twice the precision of int:

void func(signed int si_a, signed int si_b) {
  signed int result = si_a * si_b;
  /* ... */
}

Compliant Solution

The product of two operands can always be represented using twice the number of bits than exist in the precision of the larger of the two operands. This compliant solution eliminates signed overflow on systems where long long is at least twice the precision of int:

Code Block

bgColor	#ccccff
lang	c

#include <stddef.h>
#include <assert.h>
#include <limits.h>
#include <inttypes.h>
 
extern size_t popcount(uintmax_t);
#define PRECISION(umax_value) popcount(umax_value) 
  
void func(signed int si_a, signed int si_b) {
  signed int result;
  signed long long tmp;
  assert(PRECISION(ULLONG_MAX) >= 2 * PRECISION(UINT_MAX));
  tmp = (signed long long)si_a * (signed long long)si_b;
 
  /*
   * If the product cannot be represented as a 32-bit integer,
   * handle as an error condition.
   */
  if ((tmp > INT_MAX) || (tmp < INT_MIN)) {
    /* Handle error */
  } else {
    result = (int)tmp;
  }
  /* ... */
}

The assertion fails if long long has less than twice the precision of int. The PRECISION() macro and popcount() function provide the correct precision for any integer type. (See INT35-C. Use correct integer precisions.)

Compliant Solution

The following portable compliant solution can be used with any conforming implementation, including those that do not have an integer type that is at least twice the precision of int:

Code Block

bgColor	#ccccff
lang	c

#include <limits.h>
 
void func(signed int si_a, signed int si_b) {
  signed int result;  
  if (si_a > 0) {  /* si_a is positive */
    if (si_b > 0) {  /* si_a and si_b are positive

Code Block

bgColor	#ccccff
lang	c

#include <limits.h>
 
void func(signed int si_a, signed int si_b) {
  signed int result;  
  if (si_a > 0) {  /* si_a is positive */
    if (si_b > 0) {  /* si_a and si_b are positive */
      if (si_a > (INT_MAX / si_b)) {
        /* Handle error */
      }
    } else { /* si_a positive, si_b nonpositive */
      if (si_ba <> (INT_MINMAX / si_ab)) {
        /* Handle error */
      }
    } else { /* si_a positive, si_b nonpositive */
   } else { /*if (si_ab is nonpositive */
    if (si_b > 0) { /* si_a is nonpositive, si_b is positive */
      if (si_a < (< (INT_MIN / si_ba)) {
        /* Handle error */
      }
    } else { /* si_a andpositive, si_b are nonpositive */
  } else { /* si_a is nonpositive */
    if ( (si_b > 0) { /* si_a != 0) &&is nonpositive, si_b is positive */
      if (si_ba < (INT_MAXMIN / si_a)b)) {
        /* Handle error */
      }
    } else { /* End if si_a and si_b are nonpositive */
  }  /* End if ( (si_a is nonpositive != 0) && (si_b < (INT_MAX / si_a))) {
        /* Handle error */
      }
    } /* resultEnd =if si_a *and si_b;
}

...

 are nonpositive */
  } /* End if si_a is nonpositive */

  result = si_a * si_b;
}

Compliant Solution (GNU)

This compliant solution uses the GNU extension __builtin_smul_overflow, available with GCC, Clang, and ICC:

Code Block

bgColor	#ccccff
lang	c

void func(signed int si_a, signed int si_b) {
  signed int result;
  if (__builtin_smul_overflow(si_a, si_b, &result)) {
    /* Handle error */
  }
}

Division

Division is between two operands of arithmetic type. Overflow can occur during two's complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. Division operations are also susceptible to divide-by-zero errors. (See

...

Division

Division is between two operands of arithmetic type. Overflow can occur during two's complement signed integer division when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. Division operations are also susceptible to divide-by-zero errors (see INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors).

Noncompliant Code Example

This noncompliant code example prevents divide-by-zero errors in compliance with INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors.)

Noncompliant Code Example

This noncompliant code example prevents divide-by-zero errors in compliance with INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors but does not but does not prevent a signed integer overflow error in two's-complement.

...

On the x86-32 architecture, overflow results in a fault, which can be exploited as a denial-of-service attack.

Compliant Solution

This compliant solution eliminates the possibility of divide-by-zero errors or signed overflow:

Code Block

bgColor	#ccccff
lang	c

#include <limits.h>
 
void func(signed long s_a, signed long s_b) {
  signed long result;
  if ((s_b == 0) || ((s_a == LONG_MIN) && (s_b == -1))) {
    /* Handle error */
  } else {
    result = s_a / s_b;
  }
  /* ... */
}

...

Remainder

The remainder operator provides the remainder when two operands of integer type are divided. Because many platforms implement remainder and division in the same instruction, the remainder operator is also susceptible to arithmetic overflow and division by zero zero. (see See INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors.).

Noncompliant Code Example

Many hardware architectures implement remainder as part of the division operator, which can overflow. Overflow can occur during a remainder operation when the dividend is equal to the minimum (negative) value for the signed integer type and the divisor is equal to −1. It occurs even though the result of such a remainder operation is mathematically 0. This noncompliant code example prevents divide-by-zero errors in compliance with INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors but does not prevent integer overflow:

...

On x86-32 platforms, the remainder operator for signed integers is implemented by the idiv instruction the idiv instruction code, along with the divide operator. Because LONG_MIN / −1 overflows, this code will throw a floating-point exception on it results in a software exception with LONG_MIN % −1 as well.

Compliant Solution

This compliant solution also tests the remainder operands to guarantee there is no possibility of an overflow:

Code Block

bgColor	#ccccff
lang	c

#include <limits.h>
 
void func(signed long s_a, signed long s_b) {
  signed long result;
  if ((s_b == 0 ) || ((s_a == LONG_MIN) && (s_b == -1))) {
    /* Handle error */
  } else {
    result = s_a % s_b;
  }  
  /* ... */
}

...

Left-Shift Operator

...

Left-Shift Operator

The left-shift operator takes two integer operands. The result of E1 << E2 is E1 left-shifted E2 bit positions; vacated bits are filled with zeros.

The C Standard, 66.5.78, paragraph 4 [ISO/IEC 9899:20112024], states:

If E1 has a signed type and nonnegative value, and E1 × 2^E2 is representable in the result type, then that is the resulting value; otherwise, the behavior is undefined.

In almost every case, an attempt to shift by a negative number of bits or by more bits than exist in the operand indicates a logic error. These issues are covered by INT34-C. Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand.

Noncompliant Code Example

This noncompliant code example performs a left shift, after verifying that the number being shifted is not negative, and the number of bits to shift is valid. The PRECISION() macro and popcount() function provide the correct precision for any integer type. (see See INT35-C. Use correct integer precisions.) . However, because this code does no overflow check, it can result in an unrepresentable value.

Code Block

bgColor	#FFcccc
lang	c

#include <limits.h>
#include <stddef.h>
#include <inttypes.h>
 
extern size_t popcount(uintmax_t);
#define PRECISION(umax_value) popcount(umax_value) 

void func(signed long si_a, signed long si_b) {
  signed long result;
  if ((si_a < 0) || (si_b < 0) ||
      (si_b >= PRECISION(ULONG_MAX))) {
    /* Handle error */
  } else {
    result = si_a << si_b;
  } 
  /* ... */
}

Compliant Solution

This compliant solution eliminates the possibility of overflow resulting from a left-shift operation:

Code Block

bgColor	#ccccff
lang	c

#include <limits.h>
#include <stddef.h>
#include <inttypes.h>
 
extern size_t popcount(uintmax_t);
#define PRECISION(umax_value) popcount(umax_value) 

void func(signed long si_a, signed long si_b) {
  signed long result;
  if ((si_a < 0) || (si_b < 0) ||
      (si_b >= PRECISION(ULONG_MAX)) ||
      (si_a > (LONG_MAX >> si_b))) {
    /* Handle error */
  } else {
    result = si_a << si_b;
  } 
  /* ... */
}

...

Unary Negation

...

Unary Negation

The unary negation operator takes an operand of arithmetic type. Overflow can occur during two's complement unary negation when the operand is equal to the minimum (negative) value for the signed integer type.

Noncompliant Code Example

This noncompliant code example can result in a signed integer overflow during the unary negation of the signed operand s_a:

Code Block

bgColor	#FFcccc
lang	c

void func(signed long s_a) {
  signed long result = -s_a;
  /* ... */
}

Compliant Solution

This compliant solution tests the negation operation to guarantee there is no possibility of signed overflow:

Code Block

bgColor	#ccccff
lang	c

#include <limits.h>
 
void func(signed long s_a) {
  signed long result;
  if (s_a == LONG_MIN) {
    /* Handle error */
  } else {
    result = -s_a;
  }
  /* ... */
}

Risk Assessment

Integer overflow can lead to buffer overflows and the execution of arbitrary code by an attacker.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
INT32-C	High	Likely	High	P9	L2

Automated Detection

...

Tool

...

Version

...

Checker

...

Description

...

ALLOC.SIZE.ADDOFLOW

ALLOC.SIZE.IOFLOW

ALLOC.SIZE.MULOFLOW

ALLOC.SIZE.SUBUFLOW

MISC.MEM.SIZE.ADDOFLOW

MISC.MEM.SIZE.BAD

MISC.MEM.SIZE.MULOFLOW

MISC.MEM.SIZE.SUBUFLOW

...

Addition overflow of allocation size

Integer overflow of allocation size

Multiplication overflow of allocation size

Subtraction underflow of allocation size

Addition overflow of size

Unreasonable size argument

Multiplication overflow of size

Subtraction underflow of size

...

Fortify SCA

...

5.0

...

Can detect violations of this rule with CERT C Rule Pack. Specifically, it checks to ensure that the operand of a unary negation is compared to the type's minimum value immediately before the operation

...

LDRA tool suite

...

43 D
493 S
494 S

...

2800, 2801, 2802, 2803

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...

INT02-C. Understand integer conversion rules
INT35-C. Use correct integer precisions
INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors
INT34-C. Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand
ARR30-C. Do not form or use out-of-bounds pointers or array subscripts
ARR36-C. Do not subtract or compare two pointers that do not refer to the same array
ARR37-C. Do not add or subtract an integer to a pointer to a non-array object
MSC15-C. Do not depend on undefined behavior
CON08-C. Do not assume that a group of calls to independently atomic methods is atomic

...

    result = -s_a;
  }
  /* ... */
}

Risk Assessment

Integer overflow can lead to buffer overflows and the execution of arbitrary code by an attacker.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
INT32-C	High	Likely	High	P9	L2

Automated Detection

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

integer-overflow

Fully checked

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

ALLOC.SIZE.ADDOFLOW
ALLOC.SIZE.IOFLOW
ALLOC.SIZE.MULOFLOW
ALLOC.SIZE.SUBUFLOW
MISC.MEM.SIZE.ADDOFLOW
MISC.MEM.SIZE.BAD
MISC.MEM.SIZE.MULOFLOW
MISC.MEM.SIZE.SUBUFLOW

Addition overflow of allocation size
Integer overflow of allocation size
Multiplication overflow of allocation size
Subtraction underflow of allocation size
Addition overflow of size
Unreasonable size argument
Multiplication overflow of size
Subtraction underflow of size

Coverity

Include Page

	Coverity_V
	Coverity_V

TAINTED_SCALAR

BAD_SHIFT

Implemented

Cppcheck Premium

Include Page

	Cppcheck Premium_V
	Cppcheck Premium_V

premium-cert-int32-c

Partially implemented

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

C2800, C2860

C++2800, C++2860

DF2801, DF2802, DF2803, DF2861, DF2862, DF2863

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

NUM.OVERFLOW
CWARN.NOEFFECT.OUTOFRANGE
NUM.OVERFLOW.DF

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

493 S, 494 S

Partially implemented

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_C-INT32-a
CERT_C-INT32-b
CERT_C-INT32-c

Avoid signed integer overflows
Integer overflow or underflow in constant expression in '+', '-', '*' operator
Integer overflow or underflow in constant expression in '<<' operator

Parasoft Insure++

Runtime analysis

Polyspace Bug Finder

Include Page

	Polyspace Bug Finder_V
	Polyspace Bug Finder_V

CERT C: Rule INT32-C

Checks for:

Integer overflow
Tainted division operand
Tainted modulo operand

Rule partially covered.

PVS-Studio

Include Page

	PVS-Studio_V
	PVS-Studio_V

V1026, V1070, V1081, V1083, V1085, V5010

TrustInSoft Analyzer

Include Page

	TrustInSoft Analyzer_V
	TrustInSoft Analyzer_V

signed_overflow

Exhaustively verified (see one compliant and one non-compliant example).

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

Taxonomy	Taxonomy item	Relationship
CERT C	INT02-C. Understand integer conversion rules	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C	INT35-C. Use correct integer precisions	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C	INT33-C. Ensure that division and remainder operations do not result in divide-by-zero errors	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C	INT34-C. Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C	ARR30-C. Do not form or use out-of-bounds pointers or array subscripts	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C	ARR36-C. Do not subtract or compare two pointers that do not refer to the same array	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C	ARR37-C. Do not add or subtract an integer to a pointer to a non-array object	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C	MSC15-C. Do not depend on undefined behavior	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT C	CON08-C. Do not assume that a group of calls to independently atomic methods is atomic	Prior to 2018-01-12: CERT: Unspecified Relationship
CERT Oracle Secure Coding Standard for Java	INT00-J. Perform explicit range checking to avoid integer overflow	Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TR 24772:2013	Arithmetic Wrap-Around Error [FIF]	Prior to 2018-01-12: CERT: Unspecified Relationship
ISO/IEC TS 17961	Overflowing signed integers [intoflow]	Prior to 2018-01-12: CERT: Unspecified Relationship
CWE 2.11	CWE-190, Integer Overflow or Wraparound	2017-05-18: CERT: Partial overlap
CWE 2.11	CWE-191	2017-05-18: CERT: Partial overlap
CWE 2.11	CWE-680	2017-05-18: CERT: Partial overlap

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-20 and INT32-C

See CWE-20 and ERR34-C

CWE-680 and INT32-C

Intersection( INT32-C, MEM35-C) = Ø

Intersection( CWE-680, INT32-C) =

Signed integer overflows that lead to buffer overflows

CWE-680 - INT32-C =

Unsigned integer overflows that lead to buffer overflows

INT32-C – CWE-680 =

Signed integer overflows that do not lead to buffer overflows

CWE-191 and INT32-C

Union( CWE-190, CWE-191) = Union( INT30-C, INT32-C)

Intersection( INT30-C, INT32-C) == Ø

Intersection(CWE-191, INT32-C) =

Underflow of signed integer operation

CWE-191 – INT32-C =

Underflow of unsigned integer operation

INT32-C – CWE-191 =

Overflow of signed integer operation

CWE-190 and INT32-C

Union( CWE-190, CWE-191) = Union( INT30-C, INT32-C)

Intersection( INT30-C, INT32-C) == Ø

Intersection(CWE-190, INT32-C) =

Overflow (wraparound) of signed integer operation

CWE-190 – INT32-C =

Overflow of unsigned integer operation

INT32-C – CWE-190 =

Underflow of signed integer operation

...

Bibliography

[Dowd 2006]	Chapter 6, "C Language Issues" ("Arithmetic Boundary Conditions," pp. 211–223)
[ISO/IEC 9899:

2011

2024]

Subclause 6.5.

5

8, "

Multiplicative Operators

Bitwise shift operators"
[Seacord 2013b]	Chapter 5, "Integer Security"
[Viega 2005]	Section 5.2.7, "Integer Overflow"
[Warren 2002]	Chapter 2, "Basics"

...

Image Modified Image Modified Image Modified

Space shortcuts

Page tree

Page History

Versions Compared

Old Version 251

New Version Current

Key

Implementation Details

Atomic Integers

Addition

Addition

Noncompliant Code Example

Compliant Solution

Compliant Solution (GNU)

Subtraction

Subtraction

Noncompliant Code Example

Compliant Solution

Compliant Solution (GNU)

Multiplication

Noncompliant Code Example

Compliant Solution

Multiplication

Noncompliant Code Example

Compliant Solution

Compliant Solution

Compliant Solution

Compliant Solution (GNU)

Division

Division

Noncompliant Code Example

Noncompliant Code Example

Compliant Solution

Remainder

Noncompliant Code Example

Compliant Solution

Left-Shift Operator

Left-Shift Operator

Noncompliant Code Example

Compliant Solution

Unary Negation

Unary Negation

Noncompliant Code Example

Compliant Solution

Automated Detection

Related Vulnerabilities

Related Guidelines

Automated Detection

Related Vulnerabilities

Related Guidelines

CERT-CWE Mapping Notes

CWE-20 and INT32-C

CWE-680 and INT32-C

CWE-191 and INT32-C

CWE-190 and INT32-C

Bibliography