C Language Experience Discussion (Part 5): Integer Overflow – Let Your Program Crash Silently

C Language Experience Discussion (Part 5): Integer Overflow – Let Your Program Crash Silently

📌 Application Scenarios and Issues

Integer overflow occurs when the result of an arithmetic operation exceeds the range that the data type can represent, causing the value to “wrap around” to the other end of the type’s range. This phenomenon is undefined behavior in signed integers, while it is clearly defined in unsigned integers but can still lead to logical errors. Integer overflow often triggers serious security vulnerabilities in scenarios such as memory allocation, loop counting, and array index calculations.

Common Application Scenarios:

  • Memory Allocation Calculation: Overflow in <span>malloc(count * sizeof(type))</span>
  • Loop Boundary Check: Loop counter exceeding expected range
  • Array Index Calculation: Addition overflow during index calculation
  • Timestamp Handling: Overflow issues in time-related calculations

👉 Simple Analogy: Integer overflow is like a car’s odometer—when the number reaches its maximum value, it wraps back to 0 and starts counting again. This seems harmless, but if you rely on the odometer to determine when maintenance is needed, incorrect values can lead to serious consequences.

The danger of such errors lies in the fact that the program usually does not crash but produces completely incorrect calculation results, which can lead to serious vulnerabilities such as buffer overflows, especially in security-related code.

⚠️ Error Code & Output Results

#include <stdio.h>
#include <stdlib.h>
#include <limits.h>
#include <string.h>

int main() {
    // Scenario 1: Multiplication overflow in memory allocation
    printf("=== Memory Allocation Overflow Test ===\n");
    unsigned int count = 1000000000;  // 1 billion
    unsigned int size = sizeof(int);  // usually 4 bytes

    printf("count = %u, size = %u\n", count, size);

    // ❌ Danger: Multiplication may overflow
    unsigned int total_bytes = count * size;
    printf("Calculated total bytes: %u\n", total_bytes);

    // If overflow occurs, malloc may allocate very little memory
    if (total_bytes > 0) {  // Incorrect check
        printf("Attempting to allocate %u bytes of memory\n", total_bytes);
        // int *ptr = malloc(total_bytes);  // Dangerous! Actual allocation may be very small
        // if (ptr) printf("Allocation successful\n");
    }

    // Scenario 2: Loop counter overflow
    printf("\n=== Loop Counter Overflow ===\n");
    unsigned char counter = 250;  // Close to unsigned char max value 255

    printf("Initial counter: %u\n", counter);
    for (int i = 0; i < 10; i++) {
        counter += 2;  // ❌ Increases by 2 each time, will exceed 255
        printf("Loop %d: counter = %u\n", i+1, counter);
      
        // Incorrect boundary check
        if (counter > 240) {  // ❌ This condition may fail after overflow
            printf("Warning: Counter approaching limit\n");
        }
    }

    // Scenario 3: Signed integer overflow (undefined behavior)
    printf("\n=== Signed Integer Overflow ===\n");
    int max_int = INT_MAX;
    printf("INT_MAX = %d\n", max_int);

    // ❌ Undefined behavior: signed integer overflow
    int overflow_result = max_int + 1;
    printf("INT_MAX + 1 = %d\n", overflow_result);

    // Scenario 4: Array index calculation overflow
    printf("\n=== Array Index Calculation Overflow ===\n");
    unsigned short base_index = 65530;  // Close to USHRT_MAX (65535)
    unsigned short offset = 10;

    // ❌ Index calculation overflow
    unsigned short final_index = base_index + offset;
    printf("base_index = %u, offset = %u\n", base_index, offset);
    printf("final_index = %u\n", final_index);

    // If this index is used to access an array, it will access an unexpected location
    char dummy_array[100];
    if (final_index < 100) {  // ❌ Incorrect boundary check
        printf("Index appears safe, but has actually overflowed\n");
    }

    return 0;
}

📌 Actual Output Results:

=== Memory Allocation Overflow Test ===
count = 1000000000, size = 4
Calculated total bytes: 705032704
Attempting to allocate 705032704 bytes of memory

=== Loop Counter Overflow ===
Initial counter: 250
Loop 1: counter = 252
Loop 2: counter = 254
Loop 3: counter = 0
Warning: Counter approaching limit
Loop 4: counter = 2
Loop 5: counter = 4
Loop 6: counter = 6
Loop 7: counter = 8
Loop 8: counter = 10
Loop 9: counter = 12
Loop 10: counter = 14

=== Signed Integer Overflow ===
INT_MAX = 2147483647
INT_MAX + 1 = -2147483648

=== Array Index Calculation Overflow ===
base_index = 65530, offset = 10
final_index = 4
Index appears safe, but has actually overflowed

📝 Explanation of Error Outputs:

  • Memory Allocation: 1000000000 * 4 = 4000000000, exceeds 32-bit unsigned int range, result wraps to 705032704
  • Loop Counter: 250 + 2 + 2 = 254, adding 2 again becomes 256, exceeding 255 wraps to 0
  • Signed Overflow: INT_MAX + 1 triggers undefined behavior, usually wrapping to INT_MIN
  • Array Index: 65530 + 10 = 65540, exceeding 65535 wraps to 4

👉 Error Analysis:

  1. Multiplication operation overflows on a 32-bit system, leading to incorrect memory size calculation
  2. Unsigned integer overflow has defined wrap-around behavior but disrupts program logic
  3. Signed integer overflow is undefined behavior, and the compiler may perform unexpected optimizations
  4. After overflow, the small value passed the incorrect boundary check

✅ Correct Code & Output Results

Code Function Description: The following code demonstrates the correct way to prevent integer overflow:

  • Scenario 1: Use safe multiplication checks to prevent memory allocation overflow
  • Scenario 2: Correctly detect unsigned integer addition overflow
  • Scenario 3: Safe practices to avoid signed integer overflow
  • Scenario 4: Safe boundary checks for array indices
#include <stdio.h>
#include <stdlib.h>
#include <limits.h>
#include <stdint.h>

// Safe unsigned multiplication check
int safe_multiply_uint(unsigned int a, unsigned int b, unsigned int *result) {
    if (a != 0 && b > UINT_MAX / a) {
        return -1;  // Overflow
    }
    *result = a * b;
    return 0;  // Success
}

// Safe unsigned addition check
int safe_add_uint(unsigned int a, unsigned int b, unsigned int *result) {
    if (a > UINT_MAX - b) {
        return -1;  // Overflow
    }
    *result = a + b;
    return 0;  // Success
}

int main() {
    // Scenario 1: Safe memory allocation calculation
    printf("=== Safe Memory Allocation ===\n");
    unsigned int count = 1000000000;
    unsigned int size = sizeof(int);
    unsigned int total_bytes;

    printf("count = %u, size = %u\n", count, size);

    // ✅ Safe check for multiplication overflow
    if (safe_multiply_uint(count, size, &total_bytes) == 0) {
        printf("Safely calculated total bytes: %u\n", total_bytes);
      
        // Further check if within reasonable range
        const unsigned int MAX_ALLOC = 1024 * 1024 * 1024;  // 1GB limit
        if (total_bytes <= MAX_ALLOC) {
            printf("Memory size is within reasonable limits, can allocate\n");
        } else {
            printf("Requested memory too large, allocation denied\n");
        }
    } else {
        printf("Detected multiplication overflow, allocation denied\n");
    }

    // Scenario 2: Safe loop counter handling
    printf("\n=== Safe Loop Counter ===\n");
    unsigned char counter = 250;
    unsigned char increment = 2;
    unsigned char new_counter;

    printf("Initial counter: %u\n", counter);
    for (int i = 0; i < 10; i++) {
        // ✅ Check for addition overflow
        if (safe_add_uint(counter, increment, (unsigned int*)&new_counter) == 0 && 
            new_counter <= UCHAR_MAX) {
            counter = new_counter;
            printf("Loop %d: counter = %u (safe)\n", i+1, counter);
        } else {
            printf("Loop %d: Detected overflow, stopping increment\n", i+1);
            break;
        }
      
        // Safe boundary check
        if (counter > 240) {
            printf("Warning: Counter approaching limit\n");
        }
    }

    // Scenario 3: Avoiding signed integer overflow
    printf("\n=== Safe Signed Integer Operations ===\n");
    int value = INT_MAX - 5;
    int increment = 3;

    printf("value = %d, increment = %d\n", value, increment);

    // ✅ Check for signed addition overflow
    if (value <= INT_MAX - increment) {
        int result = value + increment;
        printf("Safe addition result: %d\n", result);
    } else {
        printf("Detected potential signed integer overflow, operation blocked\n");
    }

    // Scenario 4: Safe array index calculation
    printf("\n=== Safe Array Index Calculation ===\n");
    unsigned short base_index = 65530;
    unsigned short offset = 10;
    unsigned int final_index;  // Use larger type

    printf("base_index = %u, offset = %u\n", base_index, offset);

    // ✅ Use larger type for calculation
    final_index = (unsigned int)base_index + (unsigned int)offset;
    printf("Calculated index: %u\n", final_index);

    const unsigned int ARRAY_SIZE = 100;
    if (final_index < ARRAY_SIZE) {
        printf("Index is within array bounds, can safely access\n");
    } else {
        printf("Index exceeds array bounds (%u >= %u), access blocked\n", 
               final_index, ARRAY_SIZE);
    }

    // Scenario 5: Using safer data types
    printf("\n=== Using Fixed Width Integer Types ===\n");
    uint32_t safe_count = 1000000;
    uint32_t safe_size = 4;
    uint64_t safe_total;  // Use 64-bit to avoid overflow

    safe_total = (uint64_t)safe_count * safe_size;
    printf("Using 64-bit calculation: %lu bytes\n", safe_total);

    if (safe_total <= UINT32_MAX) {
        printf("Result is within 32-bit range: %u\n", (uint32_t)safe_total);
    } else {
        printf("Result exceeds 32-bit range, requires special handling\n");
    }

    return 0;
}

📌 Correct Output Results:

=== Safe Memory Allocation ===
count = 1000000000, size = 4
Detected multiplication overflow, allocation denied

=== Safe Loop Counter ===
Initial counter: 250
Loop 1: counter = 252 (safe)
Loop 2: counter = 254 (safe)
Warning: Counter approaching limit
Loop 3: Detected overflow, stopping increment

=== Safe Signed Integer Operations ===
value = 2147483642, increment = 3
Safe addition result: 2147483645

=== Safe Array Index Calculation ===
base_index = 65530, offset = 10
Calculated index: 65540
Index exceeds array bounds (65540 >= 100), access blocked

=== Using Fixed Width Integer Types ===
Using 64-bit calculation: 4000000 bytes
Result is within 32-bit range: 4000000

📝 Explanation of Output Results:

  • Memory Allocation: Overflow check function timely detects multiplication overflow, denying dangerous memory allocation
  • Loop Counter: Detected and stopped operation before overflow occurred, avoiding logical errors
  • Signed Operations: Pre-checks for overflow, only executing safe operations
  • Array Index: Using larger data types for calculations, accurately detecting index out of bounds

✨ Comparison Points:

  • All potential overflows are detected and prevented in advance
  • Program behavior is fully controllable, with no undefined behavior
  • Error handling is clear, facilitating debugging and maintenance

🌟 Best Practices

1. Overflow Check Function Library (Highly Recommended)

What is Safe Integer Arithmetic? Before performing arithmetic operations that may overflow, check whether the operands will cause overflow. If they will, deny the operation to ensure program safety and predictability.

#include <limits.h>

// Safe signed addition
int safe_add_int(int a, int b, int *result) {
    if ((b > 0 && a > INT_MAX - b) || 
        (b < 0 && a < INT_MIN - b)) {
        return -1;  // Overflow
    }
    *result = a + b;
    return 0;
}

// Safe signed subtraction
int safe_sub_int(int a, int b, int *result) {
    if ((b < 0 && a > INT_MAX + b) || 
        (b > 0 && a < INT_MIN + b)) {
        return -1;  // Overflow
    }
    *result = a - b;
    return 0;
}

2. Compiler Built-in Checks (GCC/Clang)

#include <stdint.h>

// Using compiler built-in overflow checks
int safe_multiply_builtin(int a, int b, int *result) {
    return __builtin_mul_overflow(a, b, result);
}

int safe_add_builtin(int a, int b, int *result) {
    return __builtin_add_overflow(a, b, result);
}

// Usage example
int a = 1000000, b = 3000;
int result;
if (safe_multiply_builtin(a, b, &result)) {
    printf("Multiplication overflow\n");
} else {
    printf("Result: %d\n", result);
}

3. Compiler Flags and Static Analysis

# GCC Overflow Checks
gcc -ftrapv your_file.c  # Abort program on signed integer overflow
gcc -fwrapv your_file.c  # Signed integer overflow uses defined wrap behavior

# Static Analysis Checks
clang -fsanitize=integer your_file.c  # Runtime integer overflow detection
gcc -fsanitize=signed-integer-overflow your_file.c

# Warning Settings
gcc -Wall -Wextra -Woverflow your_file.c

4. Using Safer Data Types

#include <stdint.h>

// Use fixed-width types to avoid platform differences
uint32_t count = 1000000;
uint64_t total_size = (uint64_t)count * sizeof(int);

// Check if can safely convert back to smaller type
if (total_size <= UINT32_MAX) {
    uint32_t safe_size = (uint32_t)total_size;
    // Safe usage
} else {
    // Handle out-of-range situation
}

🏗️ Extension: Defensive Programming Approach

Safe Memory Allocation Encapsulation

#include <stdlib.h>
#include <errno.h>

void* safe_malloc(size_t count, size_t size) {
    // Check parameter validity
    if (count == 0 || size == 0) {
        errno = EINVAL;
        return NULL;
    }

    // Check for multiplication overflow
    if (count > SIZE_MAX / size) {
        errno = ENOMEM;  // Indicates requested memory too large
        return NULL;
    }

    size_t total_size = count * size;

    // Set reasonable upper limit (e.g., 512MB)
    const size_t MAX_ALLOC = 512UL * 1024 * 1024;
    if (total_size > MAX_ALLOC) {
        errno = ENOMEM;
        return NULL;
    }

    return malloc(total_size);
}

// Usage example
int *array = (int*)safe_malloc(count, sizeof(int));
if (array == NULL) {
    fprintf(stderr, "Memory allocation failed: %s\n", strerror(errno));
    return -1;
}

Safe Loop Boundary Mode

// Use larger counter type
for (uint64_t i = 0; i < very_large_count; i++) {
    // Check inside the loop if should interrupt
    if (i % 1000000 == 0) {
        printf("Processed %lu items\n", i);
      
        // Check if should stop (e.g., user interrupt, resource shortage, etc.)
        if (should_stop()) {
            break;
        }
    }
  
    // Actual work...
}

📋 Summary Checklist

  • ✅ Pre-check for Overflow: Check for potential overflow before arithmetic operations
  • ✅ Use Safe Functions: Implement or use existing safe integer operation functions
  • ✅ Compiler Support: Enable <span>-fsanitize=integer</span> and other runtime checks
  • ✅ Data Type Selection: Use sufficiently large types for intermediate calculations
  • ✅ Set Reasonable Limits: Set upper limits for critical calculations based on business logic

⚡ One-Sentence Summary: Integer overflow is a significant source of security vulnerabilities; prevention is better than cure—add overflow checks before critical operations!

Next Article Preview: C Language Experience Discussion (Part 6): Floating Point Equality Judgment – Why 0.1 + 0.2 ≠ 0.3?—Delving into floating-point precision issues and their correct handling methods.

C Language Experience Discussion (Part 5): Integer Overflow - Let Your Program Crash Silently

Related posts

  1. Mastering C Language: SpaceX Starship Test Flight Success, I Created a Simple Rocket Launch Animation with Over 100 Lines of C Code! Let’s Fly!
  2. C Language Struct Array: A Guide to Managing Data in Batches
  3. C Language Learning Notes: 100 Articles – 23. Operator Precedence and Associativity: Just Remember This One Mnemonic, Which Is… Add Parentheses
  4. C++ Competition Daily Problem – Day 822
  5. The 16th Blue Bridge Cup C++ Junior Group Provincial Competition Real Questions and Solutions
  6. Python Foundation | DAY 13 Special: Cross-Directory Module Import
  7. An Overview of the AI Agent Industry

Leave a Comment