24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them

SIN 7INTEGER OVERFLOWS

OVERVIEW OF THE SIN

Integer overflows, underflows, and arithmetic overflows of all types, especially floating point errors, have been a problem since the beginning of computer programming. Integer overflows have been a subject of security research once the easy stack-smashing attacks were largely replaced by heap exploits. While integer overflows have been involved in exploits for quite some time, in the last several years, they’re frequently the root cause of many reported issues.

The core of the problem is that for nearly every binary format in which we can choose to represent numbers, there are operations where the result isn’t what you’d get with pencil and paper. There are exceptions—some languages implement variable-size ...