Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
Bad check for overflow of integer addition¶
ID: cpp/bad-addition-overflow-check
Kind: problem
Security severity: 8.1
Severity: error
Precision: very-high
Tags:
- reliability
- correctness
- security
- external/cwe/cwe-190
- external/cwe/cwe-192
Query suites:
- cpp-code-scanning.qls
- cpp-security-extended.qls
- cpp-security-and-quality.qls
Click to see the query in the CodeQL repository
Checking for overflow of integer addition needs to be done with care, because automatic type promotion can prevent the check from working as intended, with the same value (true or false) always being returned.
Recommendation¶
Use an explicit cast to make sure that the result of the addition is not implicitly converted to a larger type.
Example¶
bool checkOverflow(unsigned short x, unsigned short y) {
// BAD: comparison is always false due to type promotion
return (x + y < x);
}
On a typical architecture where short is 16 bits and int is 32 bits, the operands of the addition are automatically promoted to int, so it cannot overflow and the result of the comparison is always false.
The code below implements the check correctly, by using an explicit cast to make sure that the result of the addition is unsigned short (which may overflow, in which case the comparison would evaluate to true).
bool checkOverflow(unsigned short x, unsigned short y) {
return ((unsigned short)(x + y) < x); // GOOD: explicit cast
}