Page History

...

For saturation semantics, assume that the mathematical result of the computation is result. The value actually returned to the user is set out in the following table:

Range of Mathematical Result	Result Returned
`MAX < result`	`MAX`
`MIN <= result <= MAX`	`result`
`result < MIN`	`MIN`

Modwrap Semantics

In modwrap semantics (also called modulo arithmetic), integer values "wrap round." That is, adding 1 to MAX produces MIN. This is the defined behavior for unsigned integers in the C Standard, subclause 6.2.5, paragraph 9. It is frequently the behavior of signed integers, as well. However, it is more sensible in many applications to use saturation semantics instead of modwrap semantics. For example, in the computation of a size (using unsigned integers), it is often better for the size to stay at the maximum value in the event of overflow rather than to suddenly become a very small value.

...

Out-of-range integer values can result in reading from or writing to arbitrary memory locations and the execution of arbitrary code.

Recommendation	Severity	Likelihood	Remediation Cost	Priority	Level
INT08-C	Medium	Probable	High	P4	L3

Automated Detection

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

integer-overflow

Fully checked

Axivion Bauhaus Suite

Include Page

	Axivion Bauhaus Suite_V
	Axivion Bauhaus Suite_V

CertC-INT08

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

ALLOC.SIZE.ADDOFLOW

ALLOC.SIZE.IOFLOW

ALLOC.SIZE.MULOFLOW

ALLOC.SIZE.SUBUFLOW

MISC.MEM.SIZE.ADDOFLOW

MISC.MEM.SIZE.BAD

MISC.MEM.SIZE.MULOFLOW

MISC.MEM.SIZE.SUBUFLOW

Addition Overflow of Allocation Size

Integer Overflow of Allocation Size

Multiplication Overflow of Allocation Size

Subtraction Underflow of Allocation Size

Addition Overflow of Size

Unreasonable Size Argument

Multiplication Overflow of Size

Subtraction Underflow of Size

Compass/ROSE

Could detect violations of this recommendation by flagging any comparison expression involving addition that could potentially overflow. For example, instead of comparing a + b < c (where b and c are compile-time constants) and b > c, the code should compare a < c - b. (This assumes a, b, c are unsigned ints. Usually b is small and c is an upper bound such as INT_MAX.)

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

C2800, C2910

DF2801, DF2802, DF2803, DF2911, DF2912, DF2913

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

488 S, 493 S, 493 S

Partially implemented

PRQA QA-C Include PagePRQA_VPRQA_V

0272 (I)
0273 (I)

Partially implemented

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_C-INT08-a
CERT_C-INT08-b
CERT_C-INT08-c
CERT_C-INT08-d

Avoid data loss when converting between integer types
Avoid signed integer overflows
Avoid value change when converting between integer types
Avoid wraparounds when performing arithmetic integer operations

PC-lint Plus

Include Page