Integer overflow: Difference between revisions

Revision as of 09:38, 20 June 2025

Revision as of 15:43, 20 June 2025

Line 15:

== Origin ==

Integer overflow occurs when an [[arithmetic]] operation on integers attempts to create a numeric value that is outside of the range that can be represented with a given number of digits. In the context of computer programming, the integers are [[Binary numeral system|binary]], but any [[Positional notation|positional]] [[numeral system]] can have an invalid result of an arithmetic operation if positions are confined. As shown in the odometer example, using the [[Decimal|decimal]] system, with the constraint of 6 positions ([[Numerical digit|digits]]) the following operation will have an invalid result: {{math|999999 + 1}}. Likewise, a binary system limited to 4 positions ([[bit|bits]]) will have an invalid result: {{code|1111 + 1}}. For both examples the results will have a value exceeding the range that can be represented by the constraints. Another way to look at this problem is that the [[Significant figures|most significant]] position's operation has a [[Carry (arithmetic)|carry]] requiring another position/digit/bit to be allocated, breaking the constraints.

The [[register width]] of a processor determines the range of values that can be represented in its registers. Though the vast majority of computers can perform multiple-precision arithmetic on operands in memory, allowing numbers to be arbitrarily long and overflow to be avoided, the register width limits the sizes of numbers that can be operated on (e.g., added or subtracted) using a single [[Instruction set architecture#Instructions|instruction]] per operation. Typical [[Binary numeral system|binary]] register widths for unsigned integers include:

* [[4-bit computing|4-bit]]: maximum representable value 2⁴ − 1 = 15

All integers in computer programming have constraints of a max value and min value. The primary factors for determining the range is the allocation of bits and if it is [[Signedness|signed or unsigned]]. The [[Integer (computer science)#Standard_integer|standard integer]] depends on the [[Computing platform|platform]] and [[programming language]]. Additional integer representation can be less than or greater than standard. Examples are the [[Integer (computer science)#Short_integer|short integer]] and [[Integer (computer science)#Long_integer|long integer]] respectively. Even [[Arbitrary-precision arithmetic|arbitrary-precision]] exists, but would be limited by [[Arbitrary-precision arithmetic#Pre-set_precision|pre-set precision]] or available system memory.

* [[8-bit computing|8-bit]]: maximum representable value 2⁸ − 1 = 255

* [[16-bit computing|16-bit]]: maximum representable value 2¹⁶ − 1 = 65,535

Using integers of the same size as the [[Arithmetic logic unit|ALU]]'s [[register width]] will have the best performance in most applications. [[Single instruction, multiple data|SIMD]] [[Instruction set architecture|instruction]] extensions can provide single operations for integers exceeding the register width. For [[x86]] [[32-bit computing|32-bit processors]] the [[Streaming SIMD extensions]] (SSE2) added registers for 64-bit integers. For [[x86-64]] [[64-bit computing|64-bit processors]] the [[Advanced Vector Extensions]] (AVX) added registers up to 512-bit integers.<ref>{{cite web|url=https://www.intel.com/content/www/us/en/content-details/812656/intel-avx-512-fast-modular-multiplication-technique-technology-guide.html|title=Intel® AVX-512 - Fast Modular Multiplication Technique}}</ref>

* [[32-bit computing|32-bit]]: maximum representable value 2³² − 1 = 4,294,967,295 (the most common width for personal computers {{as of|2005|lc=on}}),

* [[64-bit computing|64-bit]]: maximum representable value 2⁶⁴ − 1 = 18,446,744,073,709,551,615 (the most common width for personal computer [[central processing unit]]s (CPUs), {{as of|2025|lc=on}}),

{{Table alignment}}

* [[128-bit computing|128-bit]]: maximum representable value 2¹²⁸ − 1 = 340,282,366,920,938,463,463,374,607,431,768,211,455

{| class="wikitable defaultright"

|+ Integer Boundaries

|-

! Bits !! Alias !! Range !! Signed Range{{efn|name=signed}} !! Unsigned Range

|-

! rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[4-bit computing|4-bit]]

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[nibble]]

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | 2⁴ − 1 || {{small|-8}} || {{small|0}}

|-

|-

| {{small|7}} || {{small|15}}

|-

|-

! rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[8-bit computing|8-bit]]

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[byte]], [[octet (computing)|octet]]

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | 2⁸ − 1 || {{small|-128}} || {{small|0}}

|-

|-

| {{small|127}} || {{small|255}}

|-

|-

! rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[16-bit computing|16-bit]]

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[Word (data type)|word]], [[Integer (computer science)#Short_integer|short]]

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | 2¹⁶ − 1 || {{small|−32,767}} || {{small|0}}

|-

|-

| {{small|32,767}} || {{small|65,535}}

|-

|-

! rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[32-bit computing|32-bit]]{{efn|name=common2005}}

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | int32

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | 2³² − 1 || {{small|[[32-bit computing#Range_for_storing_integers|-2,147,483,648]]}} || {{small|0}}

|-

|-

| {{small|[[2,147,483,647]]}} || {{small|4,294,967,295}}

|-

|-

! rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[64-bit computing|64-bit]]{{efn|name=common2025}}

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | int64

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | 2⁶⁴ − 1 || {{small|−9,223,372,036,854,775,808}} || {{small|0}}

|-

|-

| {{small|9,223,372,036,854,775,807}} || {{small|18,446,744,073,709,551,615}}

|-

|-

! rowspan="2" style="white-space: preserve nowrap; text-align:center;" | [[128-bit computing|128-bit]]

| rowspan="2" style="text-align: center; background: #eaecf0;" | &mdash;

| rowspan="2" style="white-space: preserve nowrap; text-align:center;" | 2¹²⁸ − 1 || {{small|−170,141,183,460,469,231,731,687,303,715,884,105,728}} || {{small|0}}

|-

|-

| {{small|170,141,183,460,469,231,731,687,303,715,884,105,727}} || {{small|340,282,366,920,938,463,463,374,607,431,768,211,455}}

|-

|}

{{notelist|refs=

{{efn|name=signed|Signed Ranges are assuming [[two's complement]]}}

{{efn|name=common2005|The most common for personal computers {{as of|2005|lc=on}}.}}

{{efn|name=common2025|The most common for personal computers {{as of|2025|lc=on}}.}}

}}

When an unsigned arithmetic operation produces a result larger than the maximum above for an N-bit integer, an overflow reduces the result to [[Modulo operation|modulo]] N-th power of 2, retaining only the least significant bits of the result and effectively causing a ''wrap around''.

Line 28 ⟶ 88:

{{anchor|Security ramifications}}

Such wraparoundwrap around may cause security detriments&mdash;if an overflowed value is used as the number of bytes to allocate for a buffer, the buffer will be allocated unexpectedly small, potentially leading to a [[buffer overflow]] which, depending on the use of the buffer, might in turn cause arbitrary code execution.

If the variable has a [[Signed number representations|signed integer]] type, a program may make the assumption that a variable always contains a positive value. An integer overflow can cause the value to wrap and become negative, which violates the program's assumption and may lead to unexpected behavior (for example, 8-bit integer addition of 127 + 1 results in −128, a two's complement of 128). (A solution for this particular problem is to use unsigned integer types for values that a program expects and assumes will never be negative.)