Integer overflow: Difference between revisions

Content deleted Content added
SMWatt (talk | contribs)
m In FAA example, showed whole number of days in parenthetical remark relating 2^31 centiseconds to days. Previously showed 11 decimal places, which is not useful. Applied ceiling rather than round operator so that future edits do not inadvertently give too small a number.
Line 154:
An unhandled arithmetic overflow in the engine steering software was the primary cause of the crash of the 1996 maiden flight of the [[Ariane 5 Flight 501|Ariane 5]] rocket.<ref>{{cite web|last=Gleick|first=James|author-link=James Gleick|title=A Bug and A Crash|url=https://www.nytimes.com/1996/12/01/magazine/little-bug-big-bang.html|work=The New York Times|access-date=17 January 2019|date=1 December 1996}}</ref> The software had been considered bug-free since it had been used in many previous flights, but those used smaller rockets which generated lower acceleration than Ariane 5. Frustratingly, the part of the software in which the overflow error occurred was not even required to be running for the Ariane 5 at the time that it caused the rocket to fail&mdash; it was a launch-regime process for a smaller predecessor of the Ariane 5 that had remained in the software when it was adapted for the new rocket. Furthermore, the actual cause of the failure was a flaw in the engineering specification of how the software dealt with the overflow when it was detected: it did a diagnostic dump to its bus, which would have been connected to test equipment during software testing during development but was connected to the rocket steering motors during flight; the data dump drove the engine nozzle hard to one side which put the rocket out of aerodynamic control and precipitated its rapid breakup in the air.<ref>Official report of Ariane 5 launch failure incident.</ref>
 
On 30 April 2015, the U.S. [[Federal Aviation Authority]] announced it will order [[Boeing 787]] operators to reset its electrical system periodically, to avoid an integer overflow which could lead to loss of electrical power and [[ram air turbine]] deployment, and Boeing deployed a [[software update]] in the fourth quarter.<ref>{{cite news |title= F.A.A. Orders Fix for Possible Power Loss in Boeing 787 |first=Jad|last=Mouawad|work= [[New York Times]] |date= 30 April 2015 |url= https://www.nytimes.com/2015/05/01/business/faa-orders-fix-for-possible-power-loss-in-boeing-787.html?_r=0}}</ref> The [[European Aviation Safety Agency]] followed on 4 May 2015.<ref>{{cite web |url= http://ad.easa.europa.eu/ad/US-2015-09-07 |work= Airworthiness Directives |title= US-2015-09-07 : Electrical Power – Deactivation |date= 4 May 2015 |publisher= [[European Aviation Safety Agency]]}}</ref> The error happens after 2³¹ centiseconds (about {{#expr:ceil(2^31/100/3600/24)}} days), indicating a 32-bit [[Signed number representations|signed]] [[Integer (computer science)|integer]].
 
Overflow bugs are evident in some computer games. In the arcade game ''[[Donkey Kong (video game)|Donkey Kong]]'', [[Kill screen|it is impossible to advance past level 22]] due to an integer overflow in its time/bonus. The game takes the level number a user is on, multiplies it by 10 and adds 40. When they reach level 22, the time/bonus number is 260, which is too large for its 8-bit 256 value register, so it resets itself to 0 and gives the remaining 4 as the time/bonus – too short to finish the level. In ''[[Donkey Kong Jr. Math]]'', when trying to calculate a number over 10,000, it shows only the first 4 digits. Overflow is the cause of the famous [[kill screen|"split-screen" level]] in ''[[Pac-Man]]''.<ref>{{cite web|url=http://home.comcast.net/~jpittman2/pacman/pacmandossier.html|title=The Pac-Man Dossier|author=Pittman, Jamey}}</ref> The notorious [[Nuclear Gandhi]] bug in [[Civilization (video game)|Civilization]] was purportedly caused by an integer underflow which occurred when the game attempted to subtract 2 from Gandhi's default aggression level of 1, setting it to 255, nearly 26 times higher than the normal maximum of 10. ([[Sid Meier]] claimed in an interview that this was, in fact, intentional.) Such a bug also caused the "Far Lands" in ''[[Minecraft]]'' which existed from the Infdev development period to Beta 1.7.3; it was later fixed in Beta 1.8 but still exists in the Pocket Edition and Windows 10 Edition versions of ''Minecraft''.<ref>{{cite web|url=http://minecraft.gamepedia.com/Far_Lands|title=Minecraft Gamepedia Page|author=Minecraft Gamepedia}}</ref> In the [[Super Nintendo Entertainment System|Super NES]] game [[Lamborghini American Challenge]], the player can cause their amount of money to drop below $0 during a race by being fined over the limit of remaining money after paying the fee for a race, which glitches the integer and grants the player $65,535,000 more than it would have had after going negative.<ref>https://www.youtube.com/watch?v=aNQdQPi0xMo&t=17m55s</ref> A similar glitch occurs in [[S.T.A.L.K.E.R.: Clear Sky]] where the player can drop into a negative amount by fast travelling without sufficient funds, then proceeding to the event where the player gets robbed and has all of their currency taken away. After the game attempts to take the player's money away to an amount of $0, the player is granted 2147482963 in game currency.<ref>{{Cite web|url=https://steamcommunity.com/app/20510/discussions/0/1484358860942756615/|title = Money glitch :: S.T.A.L.K.E.R.: Clear Sky General Discussions}}</ref>