Integer overflow: Difference between revisions

Revision as of 08:57, 18 June 2025

Revision as of 04:09, 19 June 2025

Line 42:

When the ideal result of an integer operation is outside the type's representable range and the returned result is obtained by clamping, then this event is commonly defined as a saturation. Use varies as to whether a saturation is or is not an overflow. To eliminate ambiguity, the terms wrapping overflow<ref>{{cite web |url=https://www.mathworks.com/help/simulink/gui/wrap-on-overflow.html?searchHighlight=overflow&s_tid=doc_srchtitle |title=Wrap on overflow - MATLAB & Simulink |website=www.mathworks.com}}</ref> and saturating overflow<ref>{{cite web |url=https://www.mathworks.com/help/simulink/gui/saturate-on-overflow.html?searchHighlight=overflow&s_tid=doc_srchtitle |title=Saturate on overflow - MATLAB & Simulink |website=www.mathworks.com}}</ref> can be used.

Integer Underflow is an improper term used to signify the negative side of overflow. This terminology confuses the prefix "over" in overflow to be related to the [[Sign (mathematics)|sign]] of the number. Overflowing is related the boundary of bits, specifically the number's bits overflowing. In [[Two's complement|two's complement]] this overflows into the sign bit. Many references can be found to integer underflow, but lack merit. For example: CWE-191 provides two code examples that are classic overflow and cast exceptions. CWE-191 then circularly references ''24 Deadly Sins of Software Security''.<ref>{{cite web |url=https://cwe.mitre.org/data/definitions/191.html |title=CWE - CWE-191: Integer Underflow (Wrap or Wraparound) (3.1) |website=cwe.mitre.org}}</ref> This book does not define or give examples to integer underflow.<ref>{{cite book |title=24 Deadly Sins of Software Security|last=Le Blanc|first=David|page=120}}</ref>

Apple's developer's guide similarly uses the term in a section titled, "Avoiding Integer Overflows and Underflows" but then the section examines overflows without defining or talking about integer underflows.<ref>{{cite web |url=https://developer.apple.com/library/content/documentation/Security/Conceptual/SecureCodingGuide/Articles/BufferOverflows.html#//apple_ref/doc/uid/TP40002577-SW7 |title=Avoiding Buffer Overflows and Underflows |website=developer.apple.com}}</ref>. This term can also be found in bug reports and changelogs. The term maybe used improperly by the bug reporter or inexperienced engineer. These always result in a fix that is explained by another known error type such as overflow, array boundary, or improper casting.<ref>{{cite web |url=https://www.mozilla.org/en-US/security/advisories/mfsa2015-147/ |title=Integer underflow and buffer overflow processing MP4 metadata in libstagefright |website=Mozilla}}</ref>. Although underflow is not possible on integer operations, [[Arithmetic underflow|arithmetic underflow]] is possible on [[Floating-point arithmetic|floating-point operations]].

<ref>{{cite web |url=https://cwe.mitre.org/data/definitions/191.html |title=CWE - CWE-191: Integer Underflow (Wrap or Wraparound) (3.1) |website=cwe.mitre.org}}</ref>. This book does not define or give examples to integer underflow<ref>{{cite book |title=24 Deadly Sins of Software Security|last=Le Blanc|first=David|page=120}}</ref>.

Apple's developer's guide similarly uses the term in a section titled, "Avoiding Integer Overflows and Underflows" but then the section examines overflows without defining or talking about integer underflows<ref>{{cite web |url=https://developer.apple.com/library/content/documentation/Security/Conceptual/SecureCodingGuide/Articles/BufferOverflows.html#//apple_ref/doc/uid/TP40002577-SW7 |title=Avoiding Buffer Overflows and Underflows |website=developer.apple.com}}</ref>. This term can also be found in bug reports and changelogs. The term maybe used improperly by the bug reporter or inexperienced engineer. These always result in a fix that is explained by another known error type such as overflow, array boundary, or improper casting<ref>{{cite web |url=https://www.mozilla.org/en-US/security/advisories/mfsa2015-147/ |title=Integer underflow and buffer overflow processing MP4 metadata in libstagefright |website=Mozilla}}</ref>. Although underflow is not possible on integer operations, [[Arithmetic underflow|arithmetic underflow]] is possible on [[Floating-point arithmetic|floating-point operations]].

When the ideal result of an operation is not an exact integer, the meaning of overflow can be ambiguous in edge cases. Consider the case where the ideal result has a value of 127.25 and the output type's maximum representable value is 127. If overflow is defined as the ideal value being outside the representable range of the output type, then this case would be classified as an overflow. For operations that have well defined rounding behavior, overflow classification may need to be postponed until after rounding is applied. The C11 standard<ref name="auto"/> defines that conversions from floating point to integer must round toward zero. If C is used to convert the floating point value 127.25 to integer, then rounding should be applied first to give an ideal integer output of 127. Since the rounded integer is in the outputs range, the C standard would not classify this conversion as an overflow.