Integer Overflow or Wraparound

Description

The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Examples

Insecure Code

size_t len = strlen(user_input); char* buf = malloc(len * sizeof(char));

Secure Code

size_t len = strlen(user_input); if (len > SIZE_MAX / sizeof(char)) { /* handle error */ } char* buf = malloc(len * sizeof(char));

Remediation

Check for potential overflows before performing calculations and allocate sufficient memory to prevent integer overflows.

Rule Details

Field	Value
ID	CODE-0188
Category	Injection
Severity	HIGH
CWE	CWE-190
Confidence	MEDIUM
Impact	HIGH
Likelihood	MEDIUM
Exploitability	MODERATE
Tags	integer overflow, wraparound
OWASP	N/A

References

• https://www.sei.cmu.edu/downloads/sei-cert-c-coding-standard-2016-v01.pdf
• https://cwe.mitre.org/data/definitions/190
• https://dustri.org/b/playing-with-weggli.html
• https://docs.microsoft.com/en-us/cpp/sanitizers/asan-error-examples
• https://cwe.mitre.org/data/definitions/131
• https://cwe.mitre.org/data/definitions/128
• http://www.phrack.org/issues/60/10.html#article

---