Integer Underflow (Wrap or Wraparound)

Description

This can happen in signed and unsigned cases.

Demonstrations

The following examples help to illustrate the nature of this weakness and describe methods or techniques which can be used to mitigate the risk.

Note that the examples here are by no means exhaustive and any given weakness may have many subtle varieties, each of which may require different detection methods or runtime controls.

Example One

The following example subtracts from a 32 bit signed integer.

#include <stdio.h>
#include <stdbool.h>
main (void)
{
  int i;
  i = -2147483648;
  i = i - 1;
  return 0;
}

The example has an integer underflow. The value of i is already at the lowest negative value possible, so after subtracting 1, the new value of i is 2147483647.

Example Two

This code performs a stack allocation based on a length calculation.

int a = 5, b = 6;
size_t len = a - b;
char buf[len];    // Just blows up the stack
}

Since a and b are declared as signed ints, the "a - b" subtraction gives a negative result (-1). However, since len is declared to be unsigned, len is cast to an extremely large positive number (on 32-bit systems - 4294967295). As a result, the buffer buf[len] declaration uses an extremely large size to allocate on the stack, very likely more than the entire computer's memory space.

Miscalculations usually will not be so obvious. The calculation will either be complicated or the result of an attacker's input to attain the negative value.

See Also