CWE-190: Integer Overflow or Wraparound

Description

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Potential Impact

Demonstrative Examples

img_t table_ptr; /*struct containing img data, 10kB each*/int num_imgs;...num_imgs = get_num_imgs();table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs);...

nresp = packet_get_int();if (nresp > 0) {response = xmalloc(nresp*sizeof(char*));for (i = 0; i < nresp; i++) response[i] = packet_get_string(NULL);}

short int bytesRec = 0;char buf[SOMEBIGNUM];
                     while(bytesRec < MAXGET) {bytesRec += getFromInput(buf+bytesRec);}

#define JAN 1#define FEB 2#define MAR 3
                     short getMonthlySales(int month) {...}
                     float calculateRevenueForQuarter(short quarterSold) {...}
                     int determineFirstQuarterRevenue() {
                        
                           
                           // Variable for sales revenue for the quarter
                           float quarterRevenue = 0.0f;
                           short JanSold = getMonthlySales(JAN); /* Get sales in January */short FebSold = getMonthlySales(FEB); /* Get sales in February */short MarSold = getMonthlySales(MAR); /* Get sales in March */
                           
                           // Calculate quarterly total
                           short quarterSold = JanSold + FebSold + MarSold;
                           
                           // Calculate the total revenue for the quarter
                           quarterRevenue = calculateRevenueForQuarter(quarterSold);
                           saveFirstQuarterRevenue(quarterRevenue);
                           return 0;
                     }

...float calculateRevenueForQuarter(long quarterSold) {...}
                     int determineFirstQuarterRevenue() {
                        ...
                           // Calculate quarterly total
                           long quarterSold = JanSold + FebSold + MarSold;
                           
                           // Calculate the total revenue for the quarter
                           quarterRevenue = calculateRevenueForQuarter(quarterSold);
                           ...
                     }

Mitigations & Prevention

Detection Methods

• Automated Static Analysis High — This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.
• Black Box Moderate — Sometimes, evidence of this weakness can be detected using dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not b
• Manual Analysis High — This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session. Specifically, manual static analysis is useful for eval
• Automated Static Analysis - Binary or Bytecode High — According to SOAR [REF-1479], the following detection techniques may be useful:
• Dynamic Analysis with Manual Results Interpretation SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:
• Manual Static Analysis - Source Code SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:

Real-World CVE Examples

Showing 15 of 19 observed examples.

Related Weaknesses

Taxonomy Mappings

• PLOVER: — Integer overflow (wrap or wraparound)
• 7 Pernicious Kingdoms: — Integer Overflow
• CLASP: — Integer overflow
• CERT C Secure Coding: INT18-C — Evaluate integer expressions in a larger size before comparing or assigning to that size
• CERT C Secure Coding: INT30-C — Ensure that unsigned integer operations do not wrap
• CERT C Secure Coding: INT32-C — Ensure that operations on signed integers do not result in overflow
• CERT C Secure Coding: INT35-C — Evaluate integer expressions in a larger size before comparing or assigning to that size
• CERT C Secure Coding: MEM07-C — Ensure that the arguments to calloc(), when multiplied, do not wrap
• CERT C Secure Coding: MEM35-C — Allocate sufficient memory for an object
• WASC: 3 — Integer Overflows
• Software Fault Patterns: SFP1 — Glitch in computation
• ISA/IEC 62443: Part 3-3 — Req SR 3.5
• ISA/IEC 62443: Part 3-3 — Req SR 7.2
• ISA/IEC 62443: Part 4-1 — Req SR-2
• ISA/IEC 62443: Part 4-1 — Req SI-2
• ISA/IEC 62443: Part 4-1 — Req SVV-1
• ISA/IEC 62443: Part 4-1 — Req SVV-3
• ISA/IEC 62443: Part 4-2 — Req CR 3.5
• ISA/IEC 62443: Part 4-2 — Req CR 7.2